#futurerestore-help | r/Jailbreak | Page 111

lilac wren Apr 10, 2021, 4:55 AM

#

Why after 90 days

#

Why not after 30 lol

zealous bridge Apr 10, 2021, 4:56 AM

#

because thats the maximum delayperiod

royal flint Apr 10, 2021, 4:56 AM

#

unfortunately i was mistaken

lilac wren Apr 10, 2021, 4:56 AM

#

And what about in expiry date / unsigned? Does it change then as well?

royal flint Apr 10, 2021, 4:56 AM

#

if big sur pallas is any indication, the urls from like a year ago are still alive

zealous bridge Apr 10, 2021, 4:57 AM

#

tf apple

#

why do you make it this easy lmao

lilac wren Apr 10, 2021, 4:57 AM

#

Apple doesn't delete firmwares right? Again, what would change and why... How do you know this other than stating the claim

royal flint Apr 10, 2021, 4:57 AM

#

i got confused with stuff from catalogs, which does get deleted

lilac wren Apr 10, 2021, 4:57 AM

#

I feel like you should just communicate lol, it's a lot harder if you just say something with no reasoning

#

We're not even taking about signing anymore

royal flint Apr 10, 2021, 4:58 AM

#

anyways can someone please clarify what the xml is used by the device for?

zealous bridge Apr 10, 2021, 4:59 AM

#

royal flint if big sur pallas is any indication, the urls from like a year ago are still ali...

all big sur versions are signed anyway

#

i dont think them changing the urls would make much difference

#

do we know for sure this happens with ios tho

royal flint Apr 10, 2021, 4:59 AM

#

lets find a random ios 11 ota

#

and see

lilac wren Apr 10, 2021, 5:00 AM

#

The XML is downloaded from Apple to show what iOS versions are available for OTA (this is what I think). Unsupervised, we can only see 14.4.2 I think, gotta use computer tomorrow filza search is awful

zealous bridge Apr 10, 2021, 5:00 AM

#

bc i get a 403 from this 2019 one

royal flint Apr 10, 2021, 5:00 AM

#

that's a folder

zealous bridge Apr 10, 2021, 5:00 AM

#

oh right

royal flint Apr 10, 2021, 5:00 AM

#

http://updates-http.cdn-apple.com/2018/ios/091-64610-20180529-134C2002-5AD5-11E8-8D8B-547EA3E35D9E/com_apple_MobileAsset_SoftwareUpdate/9f17d4bac55dfde9cda77a3b9016d7d1d09a0cb1.zip

#

https://ipsw.me/download/ota/iPhone8,1/15F79?prerequisite=14D27

Download iOS 11.4 (15F79) OTA for iPhone 6s

zealous bridge Apr 10, 2021, 5:01 AM

#

ipsw.me’s ones dont change

royal flint Apr 10, 2021, 5:01 AM

#

lilac wren The XML is downloaded from Apple to show what iOS versions are available for OTA...

The device doesn't select tho.

zealous bridge Apr 10, 2021, 5:01 AM

#

hm

lilac wren Apr 10, 2021, 5:01 AM

#

So how does the phone know to use 14.3 if it's not in the XML? I think it's separate xml for supervised bc I think 14.3 isn't there

royal flint Apr 10, 2021, 5:01 AM

#

lilac wren So how does the phone know to use 14.3 if it's not in the XML? I think it's sepa...

because pallas giveth if you give the DelayPeriod

lilac wren Apr 10, 2021, 5:01 AM

#

But we can't test until mesu stops acting up

lilac wren Apr 10, 2021, 5:01 AM

#

royal flint because pallas giveth if you give the DelayPeriod

Really, and what happens when an MDM pushes without delay period

royal flint Apr 10, 2021, 5:02 AM

#

since when

zealous bridge Apr 10, 2021, 5:02 AM

#

then mdm field is in the request

lilac wren Apr 10, 2021, 5:02 AM

#

You sure delayperiod is necessary

lilac wren Apr 10, 2021, 5:02 AM

#

royal flint since when

Since I tested it

zealous bridge Apr 10, 2021, 5:02 AM

#

there might be a specific field for MDM pushes

lilac wren Apr 10, 2021, 5:02 AM

#

Filed?

#

Pallas field?

zealous bridge Apr 10, 2021, 5:02 AM

#

yes

lilac wren Apr 10, 2021, 5:03 AM

#

So you say delayperiod was necessary

#

Isn't completely true then?

#

And maybe 14.3 will work, supervised no delay period

zealous bridge Apr 10, 2021, 5:03 AM

#

how you gonna get the mdm field

lilac wren Apr 10, 2021, 5:03 AM

#

And that is what I'll test tomorrow

royal flint Apr 10, 2021, 5:03 AM

#

ok hold on this is interesting

lilac wren Apr 10, 2021, 5:03 AM

#

No MDM field I'll try fixing up the XML first

zealous bridge Apr 10, 2021, 5:03 AM

#

surely that’s signed with the mdm’s key or something

lilac wren Apr 10, 2021, 5:04 AM

#

Because like i said, it literally changed what the OTA showed on the Apple TV from 13.4.6 to 13.4.5... It's not all Pallas, the XML does do something

#

Mesu is the "server side" but we are being the server

zealous bridge Apr 10, 2021, 5:04 AM

#

pallas isn’t as strict on tvos

#

the xml thing clearly shows that

lilac wren Apr 10, 2021, 5:05 AM

#

Presenting an update, then the device requests that update (14.3) even though 14.4 is supposed to be shown, and we see what happens

radiant mountain Apr 10, 2021, 5:05 AM

#

zealous bridge bc i get a 403 from this 2019 one

<key>__BaseURL</key>
<string>http://updates-http.cdn-apple.com/2019/ios/091-24535-20190722-93574A92-9931-11E9-B99A-60D0A77C2E40/</string>
<key>__CanUseLocalCacheServer</key>
<true/>
<key>__QueuingServiceURL</key>
<string>https://ns.itunes.apple.com/nowserving</string>
<key>__RelativePath</key>
<string>com_apple_MobileAsset_SoftwareUpdate/902d4bef678d5819577812ba216d3750299f63c3.zip</string>

yeah you need to concat BaseURL and RelativePath

royal flint Apr 10, 2021, 5:05 AM

#

ok what the fuck

#

if you omit delayperiod but keep the other 2 keys

zealous bridge Apr 10, 2021, 5:05 AM

#

radiant mountain ```xml <key>__BaseURL</key> <string>http://updates-http.cdn-apple.com/2019/ios/0...

yh im dumb i tried to dl the parent folder lmao

royal flint Apr 10, 2021, 5:05 AM

#

you get 14.4.1

zealous bridge Apr 10, 2021, 5:06 AM

#

?

royal flint Apr 10, 2021, 5:06 AM

#

from pallas request

zealous bridge Apr 10, 2021, 5:06 AM

#

tf

lilac wren Apr 10, 2021, 5:06 AM

#

zealous bridge pallas isn’t as strict on tvos

You think there's an extra step where the device contacts Pallas before it shows the XML results? Doubt it, if anything it contacts Pallas after when it wants to update

royal flint Apr 10, 2021, 5:06 AM

#

if you do this with ios 12

#

you get 12.5.1

zealous bridge Apr 10, 2021, 5:06 AM

#

what why

lilac wren Apr 10, 2021, 5:06 AM

#

And if you turn off enforcedSoftwareUpdateDelay

royal flint Apr 10, 2021, 5:06 AM

#

lilac wren You think there's an extra step where the device contacts Pallas before it shows...

i can confirm it contacts pallas for me

royal flint Apr 10, 2021, 5:06 AM

#

zealous bridge what why

i have no clue

radiant mountain Apr 10, 2021, 5:07 AM

#

lilac wren You think there's an extra step where the device contacts Pallas before it shows...

Pretty sure you are right, from sniffin, all it does is: 1st -> get the xml, 2nd -> download the attached OTA's files

lilac wren Apr 10, 2021, 5:07 AM

#

royal flint i can confirm it contacts pallas for me

You sure? I sniffed and never saw a Pallas request when simply listing the OTA version to download

#

Only gdmf and mesu sometimes, also xp

royal flint Apr 10, 2021, 5:07 AM

#

what from gdmf

lilac wren Apr 10, 2021, 5:07 AM

#

radiant mountain Pretty sure you are right, from sniffin, all it does is: 1st -> get the xml, 2nd...

This

royal flint Apr 10, 2021, 5:07 AM

#

i mean url

zealous bridge Apr 10, 2021, 5:07 AM

#

so if we have delayperiod=0 it has no ota, and if there is no delayperiod we get 14.4.1 makes sense

royal flint Apr 10, 2021, 5:07 AM

#

gdmf.apple.com/v2/assets?

lilac wren Apr 10, 2021, 5:08 AM

#

Idk I can check until tomorrow

royal flint Apr 10, 2021, 5:08 AM

#

zealous bridge so if we have delayperiod=0 it has no ota, and if there is no delayperiod we get...

nah delayperiod 0 is 400 bad request from pallas

zealous bridge Apr 10, 2021, 5:08 AM

#

yeah so no ota

#

in the end

royal flint Apr 10, 2021, 5:08 AM

#

o

#

yea i misinterpreted

royal flint Apr 10, 2021, 5:08 AM

#

lilac wren Idk I can check until tomorrow

but you do know gdmf is pallas right

lilac wren Apr 10, 2021, 5:09 AM

#

Yes I'm making a writeup for that soon, Apple has a flaw where minimum and maximum for profiles is 0-90 instead of 1-90

lilac wren Apr 10, 2021, 5:09 AM

#

royal flint but you do know gdmf *is* pallas right

Yes Tb explained it to us

royal flint Apr 10, 2021, 5:09 AM

#

ok good

lilac wren Apr 10, 2021, 5:09 AM

#

Or was it in the group chat with folky

zealous bridge Apr 10, 2021, 5:09 AM

#

gc

lilac wren Apr 10, 2021, 5:09 AM

#

There was a specific endpoint

#

I remember because I sniffed a Pallas earlier today

#

With 50 day delay

royal flint Apr 10, 2021, 5:09 AM

#

zealous bridge gc

can u check?

#

i am 99.99% sure what you are talking about is gdmf.apple.com/v2/assets

zealous bridge Apr 10, 2021, 5:10 AM

#

it has to be

#

uh maybe in like half an hour or so its like 6am

royal flint Apr 10, 2021, 5:10 AM

#

oof

zealous bridge Apr 10, 2021, 5:11 AM

#

@lilac wren what were u using to sniff

lilac wren Apr 10, 2021, 5:11 AM

#

Proxyman or Charles

royal flint Apr 10, 2021, 5:11 AM

#

wut

#

how did you bypass pinning

zealous bridge Apr 10, 2021, 5:11 AM

#

^

royal flint Apr 10, 2021, 5:11 AM

#

mobileassetd refused to cooperate if i didn't exclude gdmf

lilac wren Apr 10, 2021, 5:11 AM

#

Nyu showed me a tweak

royal flint Apr 10, 2021, 5:12 AM

#

ios ssl killer or something?

lilac wren Apr 10, 2021, 5:12 AM

#

From Julio Verne repo

#

Yeah that

zealous bridge Apr 10, 2021, 5:12 AM

#

royal flint Apr 10, 2021, 5:13 AM

#

that one doesnt work

#

need one from jv

zealous bridge Apr 10, 2021, 5:13 AM

#

dont see any others..

royal flint Apr 10, 2021, 5:13 AM

#

google repo

zealous bridge Apr 10, 2021, 5:13 AM

#

julioverne.github.io

royal flint Apr 10, 2021, 5:13 AM

#

the tweak itself is called SSL Killer v2 or something

#

yes

zealous bridge Apr 10, 2021, 5:14 AM

#

ok got it

lilac wren Apr 10, 2021, 5:14 AM

#

Found it

#

Proxyman has an iOS app very handy

royal flint Apr 10, 2021, 5:15 AM

#

not working for me, what did you do after installing

#

oh

#

did i forget to turn it on

#

oops

lilac wren Apr 10, 2021, 5:15 AM

#

You have to turn it on

#

?

royal flint Apr 10, 2021, 5:15 AM

#

yea although it was already on

lilac wren Apr 10, 2021, 5:15 AM

#

Oh for me it came on

royal flint Apr 10, 2021, 5:15 AM

#

still getting errors

lilac wren Apr 10, 2021, 5:16 AM

#

I gtg to bed but see you tomorrow!! Hopefully we can get something working

royal flint Apr 10, 2021, 5:16 AM

#

aight same

#

ping me tomorrow

zealous bridge Apr 10, 2021, 5:16 AM

#

cya! i’ll work on this too

lilac wren Apr 10, 2021, 5:16 AM

#

Will do

royal flint Apr 10, 2021, 5:16 AM

#

research gang

zealous bridge Apr 10, 2021, 5:16 AM

#

what do you install on device then

#

got charles

royal flint Apr 10, 2021, 5:17 AM

#

add proxy

zealous bridge Apr 10, 2021, 5:18 AM

#

tf are the proxy settings on ios

royal flint Apr 10, 2021, 5:18 AM

#

uh idk

#

i just use a profile lmao

royal flint Apr 10, 2021, 5:19 AM

#

zealous bridge tf are the proxy settings on ios

uhhh

#

wifi network settings

#

yea that should be it

zealous bridge Apr 10, 2021, 5:19 AM

#

dont see shit tbh

royal flint Apr 10, 2021, 5:19 AM

#

scroll down?

#

idk

zealous bridge Apr 10, 2021, 5:19 AM

#

just ip and dns

royal flint Apr 10, 2021, 5:19 AM

#

on Android rn

radiant mountain Apr 10, 2021, 5:19 AM

#

Wifi press I button then on bottom theres is proxy settings

#

Wont appear if you have a profile that manage proxy for u

zealous bridge Apr 10, 2021, 5:20 AM

#

i literally dont see it

#

oh

#

fucking mybloxx

radiant mountain Apr 10, 2021, 5:20 AM

#

yup

royal flint Apr 10, 2021, 5:20 AM

#

lmao

zealous bridge Apr 10, 2021, 5:20 AM

#

I see it

royal flint Apr 10, 2021, 5:21 AM

#

aight now put in charles

#

and then open safari and go to a website and check charles

zealous bridge Apr 10, 2021, 5:21 AM

#

whats the port

royal flint Apr 10, 2021, 5:22 AM

#

Scroll down to the HTTP Proxy setting, tap Manual. Enter the IP address of your computer running Charles in the Server field, and the port Charles is running on in the Port field (usually 8888). Leave Authentication set to Off.

#

8888 ig

#

I'll try charles tomorrow

#

mitmproxy is getting a little annoying

#

keeps dying when I download big files

zealous bridge Apr 10, 2021, 5:24 AM

#

ahh to much adsense

royal flint Apr 10, 2021, 5:25 AM

#

lol

zealous bridge Apr 10, 2021, 5:25 AM

#

i just loaded up google tf

#

k time to test

royal flint Apr 10, 2021, 5:25 AM

#

autocomplete suggestions go brrrr

radiant mountain Apr 10, 2021, 5:25 AM

#

That's so weird... Supervised device -> check for update with the beta profile, can sniff the request -> add the 90_days profile -> check for update -> no request and 14.4.2 is you latest version allowed blablabla

Capture_decran_2021-04-10_a_07.23.54.png

royal flint Apr 10, 2021, 5:25 AM

#

radiant mountain That's so weird... Supervised device -> check for update with the beta profile, ...

it's probably caches somewhere

radiant mountain Apr 10, 2021, 5:25 AM

#

What is cached ?

royal flint Apr 10, 2021, 5:25 AM

#

xml

#

that's software update docs ur looking at btw

zealous bridge Apr 10, 2021, 5:26 AM

#

it is sending a request to gdfm

royal flint Apr 10, 2021, 5:26 AM

#

but it's either caching or it's just not used when delay

zealous bridge Apr 10, 2021, 5:26 AM

#

straight away

royal flint Apr 10, 2021, 5:26 AM

#

zealous bridge it is sending a request to gdfm

told ya

zealous bridge Apr 10, 2021, 5:26 AM

#

i know i never said it didnt

royal flint Apr 10, 2021, 5:26 AM

#

gdmf.apple.com/v2/assets

radiant mountain Apr 10, 2021, 5:26 AM

#

royal flint it's probably caches somewhere

The fact that my profile that I just add 2 seconds ago dont allow me to go above 14.4.2 without checking anything on apple servers ?

zealous bridge Apr 10, 2021, 5:26 AM

#

yup

royal flint Apr 10, 2021, 5:26 AM

#

zealous bridge i know i never said it didnt

ik lol

zealous bridge Apr 10, 2021, 5:27 AM

#

only checked xp and gdmf

#

wheres mesu

royal flint Apr 10, 2021, 5:27 AM

#

zealous bridge yup

thing is tho even if it does caches if froggy is right and it is different, it has to redownload

zealous bridge Apr 10, 2021, 5:27 AM

#

which will overwrite

royal flint Apr 10, 2021, 5:28 AM

#

yea but we'd see it in charles

#

has anyone tried supervised + delay from the start, from a clean wipe

#

because then there's no way it's cached

#

if no one has I can

fickle kettle Apr 10, 2021, 5:29 AM

#

troll

zealous bridge Apr 10, 2021, 5:29 AM

#

hello guy who gave me free jamf

#

how are you doing

royal flint Apr 10, 2021, 5:29 AM

#

literally only thing I have to set up after wipe on 6+ is alarm anyway

zealous bridge Apr 10, 2021, 5:29 AM

#

@royal flint that would be awesome if you did

#

dont feel anyone is in the mood to wipe today lol

royal flint Apr 10, 2021, 5:30 AM

#

lol yea I'll do it in the morning

fickle kettle Apr 10, 2021, 5:30 AM

#

@royal flint not work with charles’s no cache option?

royal flint Apr 10, 2021, 5:30 AM

#

fickle kettle <@!218455673581600770> not work with charles’s no cache option?

no I mean the device is likely storing it, i don't think the cache headers matter

fickle kettle Apr 10, 2021, 5:30 AM

#

@zealous bridge hello jamf is sucks

zealous bridge Apr 10, 2021, 5:31 AM

#

@royal flint do i setup ssl proxying too? how do i do that

royal flint Apr 10, 2021, 5:31 AM

#

zealous bridge <@!218455673581600770> do i setup ssl proxying too? how do i do that

should be on automatically no

radiant mountain Apr 10, 2021, 5:31 AM

#

royal flint has anyone tried supervised + delay from the start, from a clean wipe

I just did ! it cant be cached right ? Would it mean that it look for the delay on device too ?

fickle kettle Apr 10, 2021, 5:31 AM

#

@royal flint i think u have jb u can find i filza or icleaner

zealous bridge Apr 10, 2021, 5:31 AM

#

royal flint Apr 10, 2021, 5:31 AM

#

fickle kettle <@!218455673581600770> i think u have jb u can find i filza or icleaner

i tried

zealous bridge Apr 10, 2021, 5:31 AM

#

showing this for me

fickle kettle Apr 10, 2021, 5:31 AM

#

or reboot and hit check update

royal flint Apr 10, 2021, 5:32 AM

#

zealous bridge

look at charles preferences ig

radiant mountain Apr 10, 2021, 5:32 AM

#

Or maybe the big ass xml is cached somewhere, and delay just see that there's nothing new

fickle kettle Apr 10, 2021, 5:32 AM

#

@zealous bridge u cant maybe apple use ssl pinning

royal flint Apr 10, 2021, 5:32 AM

#

radiant mountain I just did ! it cant be cached right ? Would it mean that it look for the delay ...

you wiped, then supervised, then installed profile, then checked for updates?

royal flint Apr 10, 2021, 5:32 AM

#

fickle kettle <@!330016421817876490> u cant maybe apple use ssl pinning

we have a tweak that should bypass

fickle kettle Apr 10, 2021, 5:33 AM

#

i mean normally

radiant mountain Apr 10, 2021, 5:33 AM

#

royal flint you wiped, then supervised, then installed profile, **then** checked for updates...

Nah, check for update first, so yeah the xml may be cached.. But then, y does it check on mesu for the xml every single time when i dont have the profile ? Shouldnt it use the cached version too ?

fickle kettle Apr 10, 2021, 5:33 AM

#

im on 14.5 b7 a14 T.T

radiant mountain Apr 10, 2021, 5:33 AM

#

Make no sense

fickle kettle Apr 10, 2021, 5:34 AM

#

hmm

#

modify new update check request params

#

after update chached xml?

royal flint Apr 10, 2021, 5:34 AM

#

radiant mountain Nah, check for update first, so yeah the xml may be cached.. But then, y does it...

wait it does?

#

every time?

radiant mountain Apr 10, 2021, 5:34 AM

#

royal flint wait it does?

100% affirmative

royal flint Apr 10, 2021, 5:35 AM

#

@zealous bridge looking more and more like it just doesn't download xml when delaying

#

also we can test the signed after expire or not theory tomorrow

radiant mountain Apr 10, 2021, 5:35 AM

#

Could it be that the profile add a request on boot to get the xml in cache ? no further request are made after that ?

royal flint Apr 10, 2021, 5:35 AM

#

royal flint also we can test the signed after expire or not theory tomorrow

12.5 expires on the 11th

royal flint Apr 10, 2021, 5:36 AM

#

radiant mountain Could it be that the profile add a request on boot to get the xml in cache ? no ...

doubtful

zealous bridge Apr 10, 2021, 5:36 AM

#

royal flint <@330016421817876490> looking more and more like it just doesn't download xml wh...

whos right then

radiant mountain Apr 10, 2021, 5:36 AM

#

royal flint doubtful

Only logical option tho

zealous bridge Apr 10, 2021, 5:36 AM

#

mine didnt check mesu at all

#

this was 14.4.2

radiant mountain Apr 10, 2021, 5:36 AM

#

zealous bridge mine didnt check mesu at all

U have the delay profile ?

zealous bridge Apr 10, 2021, 5:36 AM

#

no

radiant mountain Apr 10, 2021, 5:36 AM

#

rip

royal flint Apr 10, 2021, 5:36 AM

#

what the fuck

zealous bridge Apr 10, 2021, 5:36 AM

#

mine didnt check without delay either

#

am i doing something wrong lol

radiant mountain Apr 10, 2021, 5:37 AM

#

Mine does without the profile, every-single-time

zealous bridge Apr 10, 2021, 5:37 AM

#

i dont think i am tbh

#

gdmf is normal

#

xp is normal

#

is it cached

royal flint Apr 10, 2021, 5:37 AM

#

you can see the gdmf request?

zealous bridge Apr 10, 2021, 5:37 AM

#

ye

royal flint Apr 10, 2021, 5:37 AM

#

if so then cert pinning shouldn't be an issue

#

so idk

#

@radiant mountain what ios u on

radiant mountain Apr 10, 2021, 5:38 AM

#

14.4.2 sadly

royal flint Apr 10, 2021, 5:38 AM

#

so both of u are on same ios

#

bro

#

can we just infiltrate apple

#

thanks

zealous bridge Apr 10, 2021, 5:39 AM

#

is that normal @royal flint

#

royal flint Apr 10, 2021, 5:39 AM

#

zealous bridge

check the notes tab

zealous bridge Apr 10, 2021, 5:39 AM

#

SSL Proxying not enabled

#

tf

valid adder Apr 10, 2021, 5:39 AM

#

noob lol

zealous bridge Apr 10, 2021, 5:40 AM

#

theres no settings for it either

radiant mountain Apr 10, 2021, 5:40 AM

#

wtf is this http://mesu.apple.com//assets/com_apple_MobileAsset_SharingDeviceAssets/com_apple_MobileAsset_SharingDeviceAssets.xml

royal flint Apr 10, 2021, 5:40 AM

#

o wise one, bless us with your knowledge

zealous bridge Apr 10, 2021, 5:40 AM

#

why is charles ass

valid adder Apr 10, 2021, 5:40 AM

#

I believe gdmf is pinned by the kernel

zealous bridge Apr 10, 2021, 5:40 AM

#

i have a tweak

valid adder Apr 10, 2021, 5:40 AM

#

no

#

kernel pinned

royal flint Apr 10, 2021, 5:40 AM

#

radiant mountain wtf is this http://mesu.apple.com//assets/com_apple_MobileAsset_SharingDeviceAss...

accessory images? idk

zealous bridge Apr 10, 2021, 5:40 AM

#

how did it work for froggy

radiant mountain Apr 10, 2021, 5:41 AM

#

what about this ? http://mesu.apple.com/assets/com_apple_MobileAsset_AXElementVision/com_apple_MobileAsset_AXElementVision.xml

#

VR Casque ? 👀

#

Apple Glass ? 👀

zealous bridge Apr 10, 2021, 5:42 AM

#

literally nothing else has that message

#

i believe it is cert pinning rip

royal flint Apr 10, 2021, 5:43 AM

#

zealous bridge literally nothing else has that message

does text tab on discord.com look sane

zealous bridge Apr 10, 2021, 5:43 AM

#

where tf is discord

#

oh

#

wait what

#

Lemme reinstall the tweak

royal flint Apr 10, 2021, 5:43 AM

#

make sure it's enabled

#

and maybe you need to restart or smth

#

idk

zealous bridge Apr 10, 2021, 5:44 AM

#

resprung

#

disable certification validation is on

royal flint Apr 10, 2021, 5:44 AM

#

only need to respring, nvm them

#

oh

#

it says kill and restart the app you want to test

zealous bridge Apr 10, 2021, 5:45 AM

#

oh

#

so reboot and rejb?

royal flint Apr 10, 2021, 5:45 AM

#

that should sork

#

*work

zealous bridge Apr 10, 2021, 5:45 AM

#

ok

radiant mountain Apr 10, 2021, 5:47 AM

#

royal flint wait it does?

ooops I was wrong, it was requesting every-single-time the 14.5 beta .zip, not the xml, which mean the xml is cached

royal flint Apr 10, 2021, 5:47 AM

#

smh

radiant mountain Apr 10, 2021, 5:48 AM

#

peepoPlaytypus

royal flint Apr 10, 2021, 5:48 AM

#

guess im erasing then

zealous bridge Apr 10, 2021, 5:48 AM

#

rip

royal flint Apr 10, 2021, 5:48 AM

#

i mean it's fast

zealous bridge Apr 10, 2021, 5:48 AM

#

yay i can see requests

royal flint Apr 10, 2021, 5:48 AM

#

it works?

#

yay

#

maybe that's why it didn't work for me

#

i didn't restart

royal flint Apr 10, 2021, 5:49 AM

#

zealous bridge yay i can see requests

gdmf too?

zealous bridge Apr 10, 2021, 5:49 AM

#

https://gdmf.apple.com/v2/assets

royal flint Apr 10, 2021, 5:49 AM

#

yee, you can see the text?

#

should be a bunch of base64

zealous bridge Apr 10, 2021, 5:49 AM

#

json format

royal flint Apr 10, 2021, 5:49 AM

#

sorry base64 is response

#

that's good

radiant mountain Apr 10, 2021, 5:50 AM

#

royal flint guess im erasing then

All the mesu request I send above were done at starting, how would you know if a mobileupdate.xml is not done on starting if you dont have settled your proxy first ?

zealous bridge Apr 10, 2021, 5:50 AM

#

MESUUUU

royal flint Apr 10, 2021, 5:50 AM

#

oh?

zealous bridge Apr 10, 2021, 5:50 AM

#

oh its gone

royal flint Apr 10, 2021, 5:51 AM

#

radiant mountain All the mesu request I send above were done at starting, how would you know if a...

doesn't have internet

zealous bridge Apr 10, 2021, 5:51 AM

#

i just saw it tf

royal flint Apr 10, 2021, 5:51 AM

#

u can activate offline remember

radiant mountain Apr 10, 2021, 5:52 AM

#

y did my message diseaper ? 😦

royal flint Apr 10, 2021, 5:52 AM

#

idk

radiant mountain Apr 10, 2021, 5:52 AM

#

Was a very dumb idea i know but still...

zealous bridge Apr 10, 2021, 5:52 AM

#

damn i can spy on everyone now 😎

royal flint Apr 10, 2021, 5:52 AM

#

zealous bridge damn i can spy on everyone now 😎

lol

zinc moon Apr 10, 2021, 5:52 AM

#

zealous bridge damn i can spy on everyone now 😎

Haram

zealous bridge Apr 10, 2021, 5:54 AM

#

if i do get mesu to show up again

#

what should i look for

royal flint Apr 10, 2021, 5:54 AM

#

just save the request

#

and response

#

if it's a get save the url

#

if it's a post save url and data

radiant mountain Apr 10, 2021, 5:55 AM

#

zealous bridge if i do get mesu to show up again

If DhinakG is right, you wont, as the big ass xml is cached, and no further request would be made til then

royal flint Apr 10, 2021, 5:55 AM

#

well froggy is saying it's cached

royal flint Apr 10, 2021, 5:55 AM

#

zealous bridge if i do get mesu to show up again

were you on delay prof when this happened

zealous bridge Apr 10, 2021, 5:56 AM

#

internet

#

ok

#

i see mesu

#

but

#

i dont think its what im looking for

radiant mountain Apr 10, 2021, 5:56 AM

#

I remember seeing mesu request every single time when i didnt had the delay profile... could be wrong

royal flint Apr 10, 2021, 5:56 AM

#

Show

zealous bridge Apr 10, 2021, 5:56 AM

#

royal flint were you on delay prof when this happened

no

#

im going on it now

#

#

lol

#

lol

royal flint Apr 10, 2021, 5:56 AM

#

scam

zealous bridge Apr 10, 2021, 5:57 AM

#

but yeah

#

gdmf is the first thing it checks

#

consistently

#

royal flint Apr 10, 2021, 5:58 AM

#

tf it doin with mesu then

zealous bridge Apr 10, 2021, 5:58 AM

#

it checked the delayperiod

#

even before it checked mesu

royal flint Apr 10, 2021, 5:59 AM

#

if you intercept gdmf

#

and just don't let it respond

#

does it say unable to check

zealous bridge Apr 10, 2021, 6:00 AM

#

wdym

#

oh

#

i blocked it

royal flint Apr 10, 2021, 6:01 AM

#

zealous bridge Apr 10, 2021, 6:01 AM

#

and yes

#

it does say

#

unable to check

royal flint Apr 10, 2021, 6:01 AM

#

ok then that should prevent any mesu request from occuring once I erase

#

because it'll error out on cert pin

#

so uh I guess all we can do is try to get a mesu request again?

zealous bridge Apr 10, 2021, 6:03 AM

#

yeah ig

radiant mountain Apr 10, 2021, 6:03 AM

#

DhinakG did you wipe already ?

zealous bridge Apr 10, 2021, 6:03 AM

#

i'll try different delay profiles

royal flint Apr 10, 2021, 6:03 AM

#

i was trying to work in the other direction, reverse engineer whatever sends the request but I can't find what sends it

royal flint Apr 10, 2021, 6:03 AM

#

radiant mountain DhinakG did you wipe already ?

no

#

gonna sleep soon

#

y

radiant mountain Apr 10, 2021, 6:04 AM

#

If the xml is cached, shouldnt delete the beta profile erase it too ?

royal flint Apr 10, 2021, 6:04 AM

#

not guaranteed

#

also what beta profile

radiant mountain Apr 10, 2021, 6:05 AM

#

Just tried, didnt worked, isnt weird ?

#

beta.apple.com/profile

royal flint Apr 10, 2021, 6:05 AM

#

How would that affect it

#

The normal response includes beta versions

radiant mountain Apr 10, 2021, 6:06 AM

#

No ? beta version .xml are in assets/iOS14PublicSeed/

#

not assets/.

#

https://mesu.apple.com/assets/iOS14PublicSeed/com_apple_MobileAsset_SoftwareUpdate/com_apple_MobileAsset_SoftwareUpdate.xml

#

http://mesu.apple.com/assets/com_apple_MobileAsset_SoftwareUpdate/com_apple_MobileAsset_SoftwareUpdate.xml

zealous bridge Apr 10, 2021, 6:07 AM

#

radiant mountain Apr 10, 2021, 6:07 AM

#

so removing the profile should erase the cached xml

zealous bridge Apr 10, 2021, 6:07 AM

#

yet i dont see it

royal flint Apr 10, 2021, 6:07 AM

#

radiant mountain http://mesu.apple.com/assets/com_apple_MobileAsset_SoftwareUpdate/com_apple_Mobi...

idk I'm just going off of this

radiant mountain Apr 10, 2021, 6:08 AM

#

lol

#

check the iOS version

royal flint Apr 10, 2021, 6:09 AM

#

in that case idk

#

too big for me to search on device

radiant mountain Apr 10, 2021, 6:09 AM

#

only beta in the regular asstes are 8.4.4, 9.9.14.4.2 (14.4.2 ota) and 9.9.12.5.2

#

there's no 14.5

royal flint Apr 10, 2021, 6:09 AM

#

hm

radiant mountain Apr 10, 2021, 6:10 AM

#

Thats what the profile is used for, request on assets/iOS14PublicSeed instead of assets

#

Earlier ive managed to show the 14.5 beta 7 update in "check for update" view without downloading the beta profile on fresh install

royal flint Apr 10, 2021, 6:11 AM

#

well

#

im gonna go to sleep

radiant mountain Apr 10, 2021, 6:11 AM

#

Didnt try to install it tho

#

Well me too, was fun, hopefully we can get something out of all this, 8am and still no sleep

royal flint Apr 10, 2021, 6:12 AM

#

@zealous bridge ping me with update imma sleep

#

gn

radiant mountain Apr 10, 2021, 6:12 AM

#

gn

zealous bridge Apr 10, 2021, 6:13 AM

#

royal flint <@330016421817876490> ping me with update imma sleep

gn, sleep welll

fickle kettle Apr 10, 2021, 6:34 AM

#

shipping tomorrow 3 new ip12 mini hope 14.3 applied

zealous bridge Apr 10, 2021, 6:34 AM

#

ooh

#

check the serial

fickle kettle Apr 10, 2021, 6:34 AM

#

@keen mica mdm can upgrade 14.3 support a14?

#

oops missed ping

#

sorrt

#

y

#

@zealous bridge

zealous bridge Apr 10, 2021, 6:35 AM

#

no-one’s tried it

fickle kettle Apr 10, 2021, 6:35 AM

#

oh

zealous bridge Apr 10, 2021, 6:35 AM

#

but i imagine its the same as supervised

fickle kettle Apr 10, 2021, 6:35 AM

#

hmm

#

use reincubate lookup check the serial

zealous bridge Apr 10, 2021, 6:37 AM

#

yeah

fickle kettle Apr 10, 2021, 6:37 AM

#

thx

#

when i got jb deeping together

zealous bridge Apr 10, 2021, 6:37 AM

#

alright

fickle kettle Apr 10, 2021, 6:38 AM

#

👍

royal flint Apr 10, 2021, 6:45 AM

#

@zealous bridge o yea now that you have charles working see if mdm makes any difference in pallas request

zealous bridge Apr 10, 2021, 6:45 AM

#

Oh yeah true

celest basalt Apr 10, 2021, 9:02 AM

#

@zealous bridge i saw on the cfw website that you might be able to change the systemversion.plist to perhaps get mybloxxx to work

#

and downgrade from a version to 14.3, has anyone confirmed this?

valid adder Apr 10, 2021, 9:06 AM

#

please dont modify that file

zinc moon Apr 10, 2021, 9:07 AM

#

valid adder please dont modify that file

?

#

Why not

zinc moon Apr 10, 2021, 9:07 AM

#

celest basalt <@!330016421817876490> i saw on the cfw website that you might be able to change...

Doesn’t work lol

celest basalt Apr 10, 2021, 10:25 AM

#

celest basalt and downgrade from a version to 14.3, has anyone confirmed this?

one person did it, but everyone else (including me) failed

#

the SEP just refuses to generate the BCert that's required to authenticate the delayed OTA for some reason

#

the logs say "baa request" btw, whatever that is

warm prism Apr 10, 2021, 10:26 AM

#

baa

celest basalt Apr 10, 2021, 10:26 AM

#

6cfc7000 : Enabling managed request
6cfc7000 : AMAuthInstallHttpRequestBaaCertificate: Error creating baa request : Error Domain=com.apple.MobileActivation.ErrorDomain Code=-1 "Failed to create reference key." UserInfo={NSLocalizedDescription=Failed to create reference key., NSUnderlyingError=0x1037187a0 {Error Domain=com.apple.MobileActivation.ErrorDomain Code=-1 "Failed to create ref key." UserInfo={NSLocalizedDescription=Failed to create ref key., NSUnderlyingError=0x103713ce0 {Error Domain=NSOSStatusErrorDomain Code=-25300 "Key generation failed, error -25300" UserInfo={numberOfErrorsDeep=0, NSDescription=Key generation failed, error -25300}}}}}
6cfc7000 : AMAuthInstallHttpRequestBaaCertificate: refKey is NULL
6cfc7000 : Failed to enable managed request. Continuing personalization without managed request

#

interesting how it somehow seems tied to the activation servers too

#

I did see requests to albert.apple.com but haven't been able to decrypt it

zealous bridge Apr 10, 2021, 10:32 AM

#

celest basalt I did see requests to albert.apple.com but haven't been able to decrypt it

activation server lmao

celest basalt Apr 10, 2021, 10:32 AM

#

yeah

zealous bridge Apr 10, 2021, 10:33 AM

#

celest basalt ``` 6cfc7000 : Enabling managed request 6cfc7000 : AMAuthInstallHttpRequestBaaCe...

BAA is Basic Attestation Authority

celest basalt Apr 10, 2021, 10:33 AM

#

oh hmm

zealous bridge Apr 10, 2021, 10:33 AM

#

https://support.apple.com/lv-lv/guide/security/sec1f90fbad1/web

Apple Support

LocalPolicy signing-key creation and management

When macOS is first installed in the factory, or when a tethered erase-install is performed, the Mac runs code from temporary restore RAM disk to initialize the default state.

celest basalt Apr 10, 2021, 10:34 AM

#

yeah I remember seeing that in the cert

zealous bridge Apr 10, 2021, 10:34 AM

#

So, for instance, for “personalized” signatures, the certificate constraints will contain “ECID must exist,” and for “global” signatures, it will contain “ECID must not exist.” These constraints ensure that all Image4 files signed by a given key must conform to certain requirements to avoid erroneous signed Image4 manifest generation.

celest basalt Apr 10, 2021, 10:35 AM

#

the -25300 error suggests the key was not found in the keychain, maybe it's supposed to be returned to the device by the server but it isn't?

#

https://developer.apple.com/forums/thread/11129

zealous bridge Apr 10, 2021, 10:35 AM

#

it’s stored in a database in the server yes

celest basalt Apr 10, 2021, 10:35 AM

#

-25300 is errSecItemNotFound, which is a pretty standard keychain error.

zealous bridge Apr 10, 2021, 10:35 AM

#

Might be failure to verify the request

#

which could also cause the key to just not go through

#

The key is meant to be sent directly to SEP, ig maybe on higher seps it doesn’t recognise an older key

#

but a lower can recognise a higher

#

The Image4 verification library looks up the special certificate constraint OID from a certificate during signature evaluation and then mechanically evaluates the constraints specified in it

It’s definitely server sided, but is it because those certificate constraints just don’t get signed? It would make sense in this case, it says it “evaluates the conditions” of the device, and OTA’s are really not supposed to be used for downgrading, so this is definitely some kind of safety mechanism

#

honestly i think there is literally nothing we can do

celest basalt Apr 10, 2021, 10:40 AM

#

I wonder if something else can be changed to trick it, or if it just asks the SEP for its firmware version?

#

the cert itself has a SepNonce but haven't specifically seen a version, except for target iOS version

zealous bridge Apr 10, 2021, 10:41 AM

#

you’re right, but i initially thought that SEP encrypted some sort of message with the UID key to prevent that sort of tampering

#

but i haven’t seen anything to support that theory

#

@celest basalt do you think removing icloud would help since it looks like it might be the activation server

celest basalt Apr 10, 2021, 10:51 AM

#

I tried removing Find My iPhone, not iCloud completely

#

also tried with and without passcode

zealous bridge Apr 10, 2021, 10:54 AM

#

Other Remote Policy constraints may be specified by the device to prevent Security downgrade of the Local Policy without providing both the local authentication required to access the current OIK and remote authentication of the account to which the device is Activation Locked.
Oh wow they specifically said they have measures in place to prevent downgrades of the OIK (private key generated by SEP and then sent to BAA)

#

but that does beg the question

#

how does ipsw downgrading work then?

green onyx Apr 10, 2021, 11:12 AM

#

zealous bridge how does ipsw downgrading work then?

reflash sep and bb and send filesystem (simple terms ig)

#

actually

#

i dont think u can downgrade sep and bb

#

so it just flashes the latest ones

zealous bridge Apr 10, 2021, 11:13 AM

#

manually specifying exists

#

and it does work

green onyx Apr 10, 2021, 11:13 AM

#

huh

#

oh ye

#

forgot about that

#

so it reflashes sep and bb?

zealous bridge Apr 10, 2021, 11:14 AM

#

green onyx reflash sep and bb and send filesystem (simple terms ig)

true but i assume it would have to personalise all the img4s like it does in ota, so whats so different abt that

green onyx Apr 10, 2021, 11:14 AM

#

zealous bridge true but i assume it would have to personalise all the img4s like it does in ota...

good question, i think nobody knows

#

except for cryptic

#

cryptic literally studied the entire restore process

valid adder Apr 10, 2021, 11:16 AM

#

TrollFront

zealous bridge Apr 10, 2021, 11:17 AM

#

true

#

cryptic pls halp need downgrade to ios 10

valid adder Apr 10, 2021, 11:26 AM

#

ez

#

@zealous bridge my offsetfinder supports iOS 9 - 14 but it will freeze on PCI on that low a version

zealous bridge Apr 10, 2021, 11:41 AM

#

have you ever used it successfully then

valid adder Apr 10, 2021, 11:55 AM

#

nah

#

only messing around booting restoremode

zealous bridge Apr 10, 2021, 11:56 AM

#

oh

lilac wren Apr 10, 2021, 1:20 PM

#

If you don't enable ssl proxying on gdmf mesu won't come up

#

Idk why that's the case but before mesu disappeared, that was true

#

Also the Apple TV reddit post mentions that as well

#

Which probably means there's a connection between mesu and pallas

zealous bridge Apr 10, 2021, 1:29 PM

#

lilac wren If you don't enable ssl proxying on gdmf mesu won't come up

I have it on

lilac wren Apr 10, 2021, 1:46 PM

#

zealous bridge I have it on

Ik bc it's jank and sometimes doesn't appear for some reason

#

Or it's cached

zealous bridge Apr 10, 2021, 1:46 PM

#

fakin mesu

lilac wren Apr 10, 2021, 1:54 PM

#

In the request to gdmf

"ClientData": {
11
    "AllowXmlFallback": "false",
12
    "DeviceAccessClient": "softwareupdateservicesd"
13
  },

#

AllowXmlFallback might be something?

#

If mesu ever comes up again, check the gdmf request to see if this is true

royal flint Apr 10, 2021, 2:00 PM

#

ayo gang

#

good morning

lilac wren Apr 10, 2021, 2:01 PM

#

Wait this is super weird
"Supervised": "true",
"DelayRequested": "false",
I'm using 0 day profile, no updates are appearing...

#

Good morning Dhinak!

low summit Apr 10, 2021, 2:02 PM

#

Morning

royal flint Apr 10, 2021, 2:02 PM

#

so
My working theory is that the xml just isn't requested when delayed

#

So I'm gonna wipe, then supervise, then install profile

#

Before checking for updates

#

That way it can't hit mesu without me knowing

radiant mountain Apr 10, 2021, 2:03 PM

#

Hey, "TLS certificate pinning" is it bc of this that you need jailbreak tweak ? The julio one

lilac wren Apr 10, 2021, 2:03 PM

#

In the gdmf response I see
"LegacyXmlUrl": ""

lilac wren Apr 10, 2021, 2:03 PM

#

royal flint So I'm gonna wipe, then supervise, then install profile

Ok, good luck. It would be great to know that mesu isn't jank and actually has a system lol

lilac wren Apr 10, 2021, 2:04 PM

#

radiant mountain Hey, "TLS certificate pinning" is it bc of this that you need jailbreak tweak ? ...

Yes, Apple won't let you sniff HTTPS response without that kill switch tweak

radiant mountain Apr 10, 2021, 2:04 PM

#

Hmm

#

Lol Burp Suite even have it's own "tweak" to bypass that

lilac wren Apr 10, 2021, 2:05 PM

#

In the gdmf response I also see 14.4.2... So what's stopping the phone from displaying it?

royal flint Apr 10, 2021, 2:05 PM

#

lilac wren In the gdmf response I also see 14.4.2... So what's stopping the phone from disp...

Where

lilac wren Apr 10, 2021, 2:05 PM

#

Assets dictionary

royal flint Apr 10, 2021, 2:05 PM

#

And what settings are you using

lilac wren Apr 10, 2021, 2:05 PM

#

0 day delay profile, supervised

royal flint Apr 10, 2021, 2:05 PM

#

With 0 day what's the value of delay period

#

I haven't gotten the tweak to work because I think I didn't reboot

lilac wren Apr 10, 2021, 2:06 PM

#

In GDMF? It doesn't show a delayperiod in the request

royal flint Apr 10, 2021, 2:06 PM

#

But imma switch to Charles today anyway

royal flint Apr 10, 2021, 2:06 PM

#

lilac wren In GDMF? It doesn't show a delayperiod in the request

What about delayrequested

lilac wren Apr 10, 2021, 2:06 PM

#

False

royal flint Apr 10, 2021, 2:06 PM

#

Hmmmmmm

lilac wren Apr 10, 2021, 2:06 PM

#

Yet the phone still shows 14.3 as latest allowed by administrator

zealous bridge Apr 10, 2021, 2:06 PM

#

supervised: true?

royal flint Apr 10, 2021, 2:06 PM

#

^

lilac wren Apr 10, 2021, 2:06 PM

#

lilac wren Yet the phone still shows 14.3 as latest allowed by administrator

My 14.3 I mean, it shows no OTA

#

Yes supervised

royal flint Apr 10, 2021, 2:07 PM

#

Hm

zealous bridge Apr 10, 2021, 2:07 PM

#

That explains the administrator message

#

but delayrequested is weird

royal flint Apr 10, 2021, 2:07 PM

#

Also

#

12.5 expires tomorrow

zealous bridge Apr 10, 2021, 2:07 PM

#

You said delayperiod0 was 400 bad request right?

lilac wren Apr 10, 2021, 2:07 PM

#

zealous bridge That explains the administrator message

No? You can be supervised without a delay period and get updates

royal flint Apr 10, 2021, 2:07 PM

#

So we can see if it's still signed and stuff

royal flint Apr 10, 2021, 2:07 PM

#

zealous bridge You said delayperiod0 was 400 bad request right?

Yes

#

But omitting delayperiod but delayrequested true gives you 14.4.1

lilac wren Apr 10, 2021, 2:08 PM

#

zealous bridge Apr 10, 2021, 2:08 PM

#

oh true

lilac wren Apr 10, 2021, 2:08 PM

#

Phonerebel and dabezt tested it on 14.0 I think, shows same message

zealous bridge Apr 10, 2021, 2:08 PM

#

supervised alone wouldnt mean that

#

Something else is there then

low summit Apr 10, 2021, 2:08 PM

#

Yes

zealous bridge Apr 10, 2021, 2:08 PM

#

That we havent looked at

low summit Apr 10, 2021, 2:08 PM

#

It shows 14.0

zealous bridge Apr 10, 2021, 2:09 PM

#

is there a “managed” field in there @lilac wren

lilac wren Apr 10, 2021, 2:09 PM

#

In the request?

zealous bridge Apr 10, 2021, 2:09 PM

#

Yes

#

thats tss but maybe its pallas too

lilac wren Apr 10, 2021, 2:09 PM

#

Nope no managed field

zealous bridge Apr 10, 2021, 2:09 PM

#

hm

royal flint Apr 10, 2021, 2:09 PM

#

Also @lilac wren. Since we have interception working we can test your theory of mdm doing something else

lilac wren Apr 10, 2021, 2:10 PM

#

True

#

I will try that after breakfast

zealous bridge Apr 10, 2021, 2:10 PM

#

Also congrats on mem pro @lilac wren

radiant mountain Apr 10, 2021, 2:11 PM

#

royal flint so My working theory is that the xml just isn't requested when delayed

Ive just wipe my device, no request are made to mesu when being supervised with the 90 profile.. onyl xp, gdmf

lilac wren Apr 10, 2021, 2:11 PM

#

Ah thanks ❤️

royal flint Apr 10, 2021, 2:11 PM

#

radiant mountain Ive just wipe my device, no request are made to mesu when being supervised with ...

Does it occur once you remove the profile?

lilac wren Apr 10, 2021, 2:11 PM

#

radiant mountain Ive just wipe my device, no request are made to mesu when being supervised with ...

Did you enable ssl proxying for gdmf

#

Otherwise it won't show up

#

And even if you do it might not show up

zealous bridge Apr 10, 2021, 2:11 PM

#

If you can view the request in gdmf that means ssl proxying is enabled right

#

in json format

royal flint Apr 10, 2021, 2:12 PM

#

Yes if it's not gibberish everything working fine

zealous bridge Apr 10, 2021, 2:12 PM

#

ok

radiant mountain Apr 10, 2021, 2:12 PM

#

lilac wren Did you enable ssl proxying for gdmf

I cant since im not jailbroken, but I can pass through TLS negotation failure and log the request domain, and the only domain that shows up there were gdmf, xp but no mesu, meaning it didnt have been called

lilac wren Apr 10, 2021, 2:13 PM

#

Idk if you can be certain though bc for some reason, mesu literally just doesn't show up as a request unless ssl is enabled for gdmf

radiant mountain Apr 10, 2021, 2:14 PM

#

🤷 i dont really know tbh, do some further research

#

I cant do much anymore since im not jailbroken

lilac wren Apr 10, 2021, 2:16 PM

#

Yeah :/ which means that we probably won't be able to fake mesu on unjailbroken devices

#

Did apple tags come out already

#

I just showed my location lol

zealous bridge Apr 10, 2021, 2:18 PM

#

I think

#

Yes you did

#

You idiot

#

lmaooo

lilac wren Apr 10, 2021, 2:18 PM

#

Ok I'm not on a beta though

zealous bridge Apr 10, 2021, 2:18 PM

#

Nvm what i was thinking abt was third party accessories gps

lilac wren Apr 10, 2021, 2:19 PM

#

royal flint Apr 10, 2021, 2:19 PM

#

Yes that's the third party integrstion

lilac wren Apr 10, 2021, 2:19 PM

#

Did this come out overnight

royal flint Apr 10, 2021, 2:19 PM

#

Uh I think a day or two ago

lilac wren Apr 10, 2021, 2:19 PM

#

Oh wow

royal flint Apr 10, 2021, 2:19 PM

#

lilac wren Apr 10, 2021, 2:20 PM

#

That's cool

zealous bridge Apr 10, 2021, 2:20 PM

#

Wonder if i have anything that I can use with it

royal flint Apr 10, 2021, 2:20 PM

#

Aight time to wipe this iphone again lmfao

zealous bridge Apr 10, 2021, 2:20 PM

#

Rip NAND flash

royal flint Apr 10, 2021, 2:20 PM

#

Let me disable icloud first so I can activate offline

radiant mountain Apr 10, 2021, 2:21 PM

#

lilac wren Yeah :/ which means that we probably won't be able to fake mesu on unjailbroken ...

Depends... on unsupervised device, it worked nicely.. Maybe if we find the good urls/xml for 14.3 or whatever it could be used in non-supervised wdyt ?

royal flint Apr 10, 2021, 2:21 PM

#

Activation lock == find my I right

#

Ah yes it is

lilac wren Apr 10, 2021, 2:22 PM

#

Yes basically

zealous bridge Apr 10, 2021, 2:22 PM

#

i’d say disable icloud = disable activation lock is a better bet

#

just to make sure

royal flint Apr 10, 2021, 2:22 PM

#

Aii

zealous bridge Apr 10, 2021, 2:22 PM

#

Since the error was in activation servers

#

Thats only for downgrading tho

royal flint Apr 10, 2021, 2:22 PM

#

Aight time to get charles

lilac wren Apr 10, 2021, 2:23 PM

#

radiant mountain Depends... on unsupervised device, it worked nicely.. Maybe if we find the good ...

Maybe, we'd just have to know the exact request for mesu so we can remap to our fake xml

zealous bridge Apr 10, 2021, 2:23 PM

#

Charles proxy + Darwin kernel = ???

royal flint Apr 10, 2021, 2:23 PM

#

Wut

#

What about the kernel

zealous bridge Apr 10, 2021, 2:24 PM

#

It was a joke about Charles Darwin nvm

royal flint Apr 10, 2021, 2:24 PM

#

Oh lmfao

stiff hazel Apr 10, 2021, 2:24 PM

#

any progress or still 0% closer than 12 hours ago

royal flint Apr 10, 2021, 2:24 PM

#

Well we have some things to try now

zealous bridge Apr 10, 2021, 2:24 PM

#

Knowledge mostly

stiff hazel Apr 10, 2021, 2:24 PM

#

royal flint Well we have some things to try now

such as?

royal flint Apr 10, 2021, 2:24 PM

#

Charles with supervised and delayed from start before doing update check

#

That way it can't sneakily hit mesu without us knowing

stiff hazel Apr 10, 2021, 2:25 PM

#

What’s Charles?

royal flint Apr 10, 2021, 2:25 PM

#

Mitm

stiff hazel Apr 10, 2021, 2:25 PM

#

oh man in the middle

zealous bridge Apr 10, 2021, 2:25 PM

#

Http proxy and packet sniffer

royal flint Apr 10, 2021, 2:26 PM

#

Alright charles is up let me just test my config before I wipe

lilac wren Apr 10, 2021, 2:27 PM

#

stiff hazel such as?

MDM sniff

#

I have that essay about hating on the SAT due tomorrow

#

Gotta do that first lol

low summit Apr 10, 2021, 2:31 PM

#

Why

#

Still?

royal flint Apr 10, 2021, 2:31 PM

#

and it works

#

wiping

green onyx Apr 10, 2021, 2:55 PM

#

lilac wren Ok I'm not on a beta though

whats this?

#

huh

lilac wren Apr 10, 2021, 2:55 PM

#

idek, added to find my iphone

green onyx Apr 10, 2021, 2:55 PM

#

omg

#

i have it too

#

huh

lilac wren Apr 10, 2021, 2:55 PM

#

I think you need a product that supports it though lol

green onyx Apr 10, 2021, 2:55 PM

#

the only product that supports it is probably airpods lol

lilac wren Apr 10, 2021, 2:56 PM

#

airpods already were supported

#

they counted as a device

green onyx Apr 10, 2021, 2:56 PM

#

hm true

lilac wren Apr 10, 2021, 2:57 PM

#

why can I hear the iPad doing stuff

#

It's uploading a file rn, iPad air 1

#

but it sounds like a very very quiet hdd

zealous bridge Apr 10, 2021, 2:57 PM

#

brrrrrrrr

lilac wren Apr 10, 2021, 2:57 PM

#

does flash make noise?

zealous bridge Apr 10, 2021, 2:57 PM

#

No

green onyx Apr 10, 2021, 2:57 PM

#

why would it make noise lmao

#

no mobile device has a fan

lilac wren Apr 10, 2021, 2:58 PM

#

idk I wonder what the iPad is doing then

green onyx Apr 10, 2021, 2:58 PM

#

probably speakers?

lilac wren Apr 10, 2021, 2:58 PM

#

no

zealous bridge Apr 10, 2021, 2:58 PM

#

Cpu ticks lmao

lilac wren Apr 10, 2021, 2:58 PM

#

it's satisfying imo

#

oh no

#

💣 📱

low summit Apr 10, 2021, 3:07 PM

#

green onyx no mobile device has a fan

Imagine it does?

royal flint Apr 10, 2021, 3:10 PM

#

i did the stupid so wiping again

lilac wren Apr 10, 2021, 3:10 PM

#

wait what'd you do lol

royal flint Apr 10, 2021, 3:10 PM

#

i forgot to restore SystemVersion.plist and then i forgot restore rootFS lmao

#

luckily checkra1n

lilac wren Apr 10, 2021, 3:11 PM

#

rip

royal flint Apr 10, 2021, 3:11 PM

#

so sshed in, fixed it, activated it, restored rootFS

#

ayy preparing actually worked properly this time

stiff hazel Apr 10, 2021, 3:16 PM

#

so what’s the goal of mitm’ing with this again? Save blobs or something else?

zealous bridge Apr 10, 2021, 3:16 PM

#

no

#

update to 14.3 after 26th April

#

without blobs

stiff hazel Apr 10, 2021, 3:18 PM

#

zealous bridge update to 14.3 after 26th April

how thonk

#

how would mitm’ing help us?

zealous bridge Apr 10, 2021, 3:18 PM

#

XML fuckery

low summit Apr 10, 2021, 3:20 PM

#

zealous bridge no

By then watch 14.4 jb comes out

zealous bridge Apr 10, 2021, 3:20 PM

#

True

low summit Apr 10, 2021, 3:20 PM

#

Then we Ota to 14.4 lol

#

Is there any success? Getting past the 90 days?

lilac wren Apr 10, 2021, 3:25 PM

#

Sniffed MDM!

#

GDMF:
"RequestedProductVersion": "14.4",

#

"DelayRequested": "false",

#

(I pushed 14.4)

zealous bridge Apr 10, 2021, 3:26 PM

#

so theres nothing specific

#

search managed or mdm

#

or something like that

lilac wren Apr 10, 2021, 3:26 PM

#

lilac wren GDMF: "RequestedProductVersion": "14.4",

this

#

right?

#

when else do you ever see requestedproductversion

zealous bridge Apr 10, 2021, 3:27 PM

#

on supervised?

#

i saw it when i did it

lilac wren Apr 10, 2021, 3:27 PM

#

i thought you see delay period? you don't see a specific requested version

zealous bridge Apr 10, 2021, 3:27 PM

#

No mdm just delay

#

Nah i 100% remember

lilac wren Apr 10, 2021, 3:27 PM

#

ill look rn

lilac wren Apr 10, 2021, 3:28 PM

#

zealous bridge Nah i 100% remember

nope, no requestedproduct with delay

zealous bridge Apr 10, 2021, 3:28 PM

#

theres no way im buggin out

#

i clearly remember

lilac wren Apr 10, 2021, 3:28 PM

#

you probably saw "ProductVersion": "14.3",

#

which is your current version

zealous bridge Apr 10, 2021, 3:28 PM

#

Might be in the response

#

I had a couple asset files

#

it wasnt in the first one

royal flint Apr 10, 2021, 3:29 PM

#

damn it charles

low summit Apr 10, 2021, 3:29 PM

#

Froggy u still need testing for restoring?

royal flint Apr 10, 2021, 3:29 PM

#

dont proxy my computer

#

want me to test requestedproduct = 14.2

zealous bridge Apr 10, 2021, 3:30 PM

#

yes please

#

if im buggin out damn i must be on some LSD or smth

lilac wren Apr 10, 2021, 3:30 PM

#

low summit Froggy u still need testing for restoring?

yes pls, mind if we talk in that DM

low summit Apr 10, 2021, 3:30 PM

#

Not now lol gtg soon

#

Just asking

lilac wren Apr 10, 2021, 3:30 PM

#

ah nw

#

well yes

zealous bridge Apr 10, 2021, 3:31 PM

#

oh wait i might have had an mdm profile installed

#

royal flint Apr 10, 2021, 3:33 PM

#

holy shit

#

it works

lilac wren Apr 10, 2021, 3:34 PM

#

you found mesu?

royal flint Apr 10, 2021, 3:34 PM

#

no

#

requestedproduct = 14.2 works

zealous bridge Apr 10, 2021, 3:34 PM

#

charles

lilac wren Apr 10, 2021, 3:34 PM

#

LOL

zealous bridge Apr 10, 2021, 3:34 PM

#

so

lilac wren Apr 10, 2021, 3:34 PM

#

is it signed?

royal flint Apr 10, 2021, 3:34 PM

#

how do i check

zealous bridge Apr 10, 2021, 3:34 PM

#

oh shit

#

uh

lilac wren Apr 10, 2021, 3:34 PM

#

can you make your phone request 14.2 or no

#

you just did it manually?

royal flint Apr 10, 2021, 3:34 PM

#

i did it from my script

zealous bridge Apr 10, 2021, 3:34 PM

#

tss response should come before the verifying error right?

#

you can check if its signed or not

royal flint Apr 10, 2021, 3:35 PM

#

i didnt test on device

lilac wren Apr 10, 2021, 3:35 PM

#

this is still my method 1/2 though, not making progress on the XML lol

#

but neat that it works

#

14.2 restore XS Max #818879231772983357 message

stiff hazel Apr 10, 2021, 3:36 PM

#

So manually requesting 14.2 pulls 14.2 but we need someone to test if 14.2 works

zealous bridge Apr 10, 2021, 3:36 PM

#

i dont think you can check if its signed on a pc lol @royal flint

royal flint Apr 10, 2021, 3:36 PM

#

yea unfortunately

zealous bridge Apr 10, 2021, 3:36 PM

#

Cause no way for the tss request to get out

#

Unless you manually get BCert

royal flint Apr 10, 2021, 3:37 PM

#

back to charles i go

lilac wren Apr 10, 2021, 3:37 PM

#

@royal flint can you send me the full response for 14.2

#

actually wait

#

let me just do my own request bc I think it's specific to phone or something right

royal flint Apr 10, 2021, 3:37 PM

#

it's not specific to device

#

it's specific to identifier and board id + current version

lilac wren Apr 10, 2021, 3:38 PM

#

"ProductType": "iPhone11,8",

#

if you don't have a XR I don't think I can map your response lol

royal flint Apr 10, 2021, 3:38 PM

#

so much commented out lmfao

royal flint Apr 10, 2021, 3:38 PM

#

lilac wren "ProductType": "iPhone11,8",

HWModelStr?

#

aka board

#

and current build, and what requested version

royal flint Apr 10, 2021, 3:40 PM

#

lilac wren if you don't have a XR I don't think I can map your response lol

my code can pretend to be anything really

#

there aren't any unique identifiers sent to pallas

lilac wren Apr 10, 2021, 3:41 PM

#

wait what's useragent header

#

nvm got it

royal flint Apr 10, 2021, 3:43 PM

#

royal flint there aren't any unique identifiers sent to pallas

well there's the nonce and pallasnonce but i think that's just random

#

but yea, give me board ID, current build, and requested version and i can get you the response

stiff hazel Apr 10, 2021, 3:47 PM

#

@royal flint so this is still useless itself unless we can update through this?

mild mural Apr 10, 2021, 3:49 PM

#

Since the 14.3 OTA trick doesn't work on futurerestored devices because they use newer SEP, what would happen if you triggered a remote iCloud wipe on the device? Does it keep the 14.4 SEP?

#

Actually now that I think of it it probably would since it's not changing OS versions

royal flint Apr 10, 2021, 3:50 PM

#

well yea this is useless if you're not jailbroken or the target version is not signed

lilac wren Apr 10, 2021, 3:50 PM

#

requesting 14.4 works but 14.2 gives me

{
  "Nonce": "DA90776C-20EC-44FA-AA1F-5E1EF967181A",
  "PallasNonce": "3AC6D3E4-988B-4601-8A1B-67FB4E5A1B31",
  "SessionId": "FEACD238-67E7-405F-BA0D-1DBECA6E454E",
  "LegacyXmlUrl": "",
  "PostingDate": "1970-01-01",
  "Transformations": {
    "_Measurement": "data",
    "SEPDigest": "data",
    "RSEPDigest": "data"
  },
  "Assets": []
}

low summit Apr 10, 2021, 3:50 PM

#

So once you have new sep u can't Ota?

royal flint Apr 10, 2021, 3:50 PM

#

show your request

lilac wren Apr 10, 2021, 3:50 PM

#

{
  "TrainName" : "AzulC",
  "SessionId" : "FEACD238-67E7-405F-BA0D-1DBECA6E454E",
  "ProductType" : "iPhone11,8",
  "AssetType" : "com.apple.MobileAsset.SoftwareUpdate",
  "ProductVersion" : "14.3",
  "DeviceClass" : 1,
  "DeviceVariant" : "A",
  "SigningFuse" : "true",
  "ClientData" : {
    "AllowXmlFallback" : "false",
    "DeviceAccessClient" : "softwareupdateservicesd"
  },
  "Nonce" : "DA90776C-20EC-44FA-AA1F-5E1EF967181A",
  "Supervised" : "true",
  "RequestedProductVersion": "14.2",
  "ProductName" : "iPhone OS",
  "NoFallback" : "true",
  "BaseUrl" : "https:\/\/mesu.apple.com\/assets\/",
  "AssetAudience" : "01c1d682-6e8f-4908-b724-5501fe3f5e5c",
  "BuildVersion" : "18C66",
  "ClientVersion" : 2,
  "InternalBuild" : "false",
  "AllowSameBuildVersion" : "false",
  "BuildID" : "238D3D4C-3940-11EB-8D33-A61B81E77CB1",
  "IsUIBuild" : "true",
  "HWModelStr" : "N841AP",
  "DeviceOSData" : {
    "SystemImageID" : "5AD8BD31-B8BD-4FD6-9C4C-90645CA26AE1",
    "BuildVersion" : "18C66",
    "DeviceVariant" : "A",
    "ProductType" : "iPhone11,8",
    "BuildID" : "238D3D4C-3940-11EB-8D33-A61B81E77CB1",
    "HWModelStr" : "N841AP",
    "DeviceName" : "iPhone",
    "ProductName" : "iPhone OS",
    "ProductVersion" : "14.3"
  },
  "SystemImageID" : "5AD8BD31-B8BD-4FD6-9C4C-90645CA26AE1",
  "DelayRequested" : "false",
  "DeviceCheck" : "Foreground",
  "CertIssuanceDay" : "2020-09-29",
  "DeviceName" : "iPhone"
}

low summit Apr 10, 2021, 3:50 PM

#

Will ipwndfu fix that?

lilac wren Apr 10, 2021, 3:51 PM

#

14.3 same message, 14.4 gives me a real response

#

14.4.1 real response

#

OH

#

because I said my current version was 14.3

#

I'm dumb

royal flint Apr 10, 2021, 3:52 PM

#

lilac wren requesting 14.4 works but 14.2 gives me ```json { "Nonce": "DA90776C-20EC-44FA...

you're on 14.3 that's why

lilac wren Apr 10, 2021, 3:52 PM

#

will change the request

leaden quarry Apr 10, 2021, 3:54 PM

#

hi guys, is it recommended to use FR on mac or on PC ?

lilac wren Apr 10, 2021, 3:55 PM

#

mac

leaden quarry Apr 10, 2021, 3:55 PM

#

okay 👍

opaque edge Apr 10, 2021, 3:55 PM

#

is talking about dualboot allowed?

lilac wren Apr 10, 2021, 3:55 PM

#

there we go got iOS 14 OTA response now

royal flint Apr 10, 2021, 3:55 PM

#

nice

low summit Apr 10, 2021, 3:55 PM

#

Pc for life

royal flint Apr 10, 2021, 3:55 PM

#

my pc runs macOS 😎

low summit Apr 10, 2021, 3:56 PM

#

Nice

#

Is it easier now?

#

Hackitosh

royal flint Apr 10, 2021, 3:56 PM

#

yes

#

y'all

#

have you added a repo and installed a tweak over ssh before

stiff hazel Apr 10, 2021, 3:57 PM

#

@royal flint dumb question: why couldn’t we request 13.x through Charles?

royal flint Apr 10, 2021, 3:57 PM

#

i think i might have to do this before activation

royal flint Apr 10, 2021, 3:57 PM

#

stiff hazel <@!218455673581600770> dumb question: why couldn’t we request 13.x through Charl...

wdym

#

we can edit the request yea

stiff hazel Apr 10, 2021, 3:57 PM

#

would 13.7 worked if we marked our current version to say 13.5.1 or something

low summit Apr 10, 2021, 3:58 PM

#

But it won't update

stiff hazel Apr 10, 2021, 3:58 PM

#

how do we necessarily know if that was to work?

royal flint Apr 10, 2021, 3:58 PM

#

we can try

#

i'm focusing on something else rn tho

stiff hazel Apr 10, 2021, 3:58 PM

#

Downgrading wouldn’t work yes

lilac wren Apr 10, 2021, 3:58 PM

#

Lol apple

stiff hazel Apr 10, 2021, 3:58 PM

#

royal flint i'm focusing on something else rn tho

Focus on that first yeah

low summit Apr 10, 2021, 3:58 PM

#

Is there a way to bypass sep check

royal flint Apr 10, 2021, 3:59 PM

#

so anyone know how to add repo and install tweak over ssh

low summit Apr 10, 2021, 3:59 PM

#

What tweak

royal flint Apr 10, 2021, 3:59 PM

#

ssl killer

low summit Apr 10, 2021, 3:59 PM

#

U need the deb

#

To install via ssh

royal flint Apr 10, 2021, 4:01 PM

#

@lilac wren can you grab deb for me?

#

currently wiping again

#

it seems to be making requests really early

lilac wren Apr 10, 2021, 4:01 PM

#

deb for ssl killer 2?

royal flint Apr 10, 2021, 4:01 PM

#

ye

lilac wren Apr 10, 2021, 4:03 PM

#

📎 com.julioverne.sslkillswitch2_0.14c_iphoneos-arm.deb

royal flint Apr 10, 2021, 4:03 PM

#

thank

zealous bridge Apr 10, 2021, 4:05 PM

#

royal flint so anyone know how to add repo and install tweak over ssh

apt add-repository [repository url]
apt update
apt install [tweak identifier]

royal flint Apr 10, 2021, 4:05 PM

#

thank

zealous bridge Apr 10, 2021, 4:05 PM

#

oh

#

nvm

royal flint Apr 10, 2021, 4:06 PM

#

uh whats a good temp location to scp it to

low summit Apr 10, 2021, 4:06 PM

#

New term works too correct @zealous bridge

zealous bridge Apr 10, 2021, 4:06 PM

#

yes

#

but

#

it will say

#

“apt does not have a stable cli interface”

royal flint Apr 10, 2021, 4:07 PM

#

oh just realized deb is useless as i need dependencies

#

rip

low summit Apr 10, 2021, 4:07 PM

#

Lol

zealous bridge Apr 10, 2021, 4:07 PM

#

and then display nothing

low summit Apr 10, 2021, 4:07 PM

#

Rip

unreal isle Apr 10, 2021, 4:19 PM

#

Any know where are the ota updates stored in the system?

lilac wren Apr 10, 2021, 4:19 PM

#

/private/var/MobileSoftwareUpdate I think

unreal isle Apr 10, 2021, 4:20 PM

#

lilac wren /private/var/MobileSoftwareUpdate I think

thanks

royal flint Apr 10, 2021, 4:21 PM

#

@lilac wren @zealous bridge

#

lilac wren Apr 10, 2021, 4:21 PM

#

finally

#

can you get it consistently?

royal flint Apr 10, 2021, 4:21 PM

#

let's see

#

yes

lilac wren Apr 10, 2021, 4:22 PM

#

supervised or no

royal flint Apr 10, 2021, 4:22 PM

#

i'm supervised and on 90 day

lilac wren Apr 10, 2021, 4:22 PM

#

yes nice

#

save that XML for sure

royal flint Apr 10, 2021, 4:22 PM

#

only problem is uh

#

it's a normal get request

#

no url parameters

zealous bridge Apr 10, 2021, 4:22 PM

#

yay

#

save it

lilac wren Apr 10, 2021, 4:22 PM

#

and in the XML, does it show 14.3 or anything specific?

royal flint Apr 10, 2021, 4:23 PM

#

well 12.4.9-12.5.1 for me

#

but no

lilac wren Apr 10, 2021, 4:23 PM

#

hm

#

it shows multiple versions?

royal flint Apr 10, 2021, 4:24 PM

#

no

#

just 12.5.2

#

by 12.4.9-12.5.1 i meant that's what it should show

#

but it is identical to a request from the browser

#

dhinak@Dhinaks-Mac-Pro ~ % shasum /Users/dhinak/Downloads/frombrowser.xml /Users/dhinak/Downloads/fromdevice.xml
1fad3c289f60bb57df43e80f00fb6b3dff6ebb48  /Users/dhinak/Downloads/frombrowser.xml
1fad3c289f60bb57df43e80f00fb6b3dff6ebb48  /Users/dhinak/Downloads/fromdevice.xml

lilac wren Apr 10, 2021, 4:24 PM

#

and if you go to /var/MobileSoftwareUpdates/MobileAsset/AssetsV2/com\_apple\_MobileAsset\_SoftwareUpdate/ and open that XML, is it the same

lilac wren Apr 10, 2021, 4:25 PM

#

royal flint just 12.5.2

shouldn't 90 day be something else though

royal flint Apr 10, 2021, 4:26 PM

#

no i meant in the xml

#

it has 12.5.2

#

it shows up to date on device for me

lilac wren Apr 10, 2021, 4:26 PM

#

what version is the device on

royal flint Apr 10, 2021, 4:26 PM

#

12.5

#

/var/MobileAsset/AssetsV2/com_apple_MobileAsset_SoftwareUpdate/com_apple_MobileAsset_SoftwareUpdate.xml for me, /var/MobileSoftwareUpdates/ doesn't have the MobileAsset folder

lilac wren Apr 10, 2021, 4:27 PM

#

strange

#

can you search for .xml in MobileSoftwareUpdates/

zealous bridge Apr 10, 2021, 4:27 PM

#

Why is it Updates for you guys

lilac wren Apr 10, 2021, 4:27 PM

#

?

zealous bridge Apr 10, 2021, 4:28 PM

#

oh nvm

#

mine shows MobileSoftwareUpdate but you probably mean that

lilac wren Apr 10, 2021, 4:28 PM

#

ah ok

zealous bridge Apr 10, 2021, 4:28 PM

#

i tried cding to it and it didnt exist

#

lol

royal flint Apr 10, 2021, 4:28 PM

#

dhinak@Dhinaks-Mac-Pro ~ % shasum ~/Downloads/from*xml   
1fad3c289f60bb57df43e80f00fb6b3dff6ebb48  /Users/dhinak/Downloads/frombrowser.xml
1fad3c289f60bb57df43e80f00fb6b3dff6ebb48  /Users/dhinak/Downloads/fromcharles.xml
533d78200ee64d4668bfba041247dcd4a932ec99  /Users/dhinak/Downloads/fromdevice2.xml

#

hmmm

lilac wren Apr 10, 2021, 4:29 PM

#

still trying to remap the gdmf response, phone is rejecting it. There's a Date field in header which also has time, hope it doesn't have to do with that. also Charles adds an extra header, I could try getting rid of it but idk if it changes anything

royal flint Apr 10, 2021, 4:29 PM

#

#

guess it's just adding some stuff before saving

#

but otherwise identical

lilac wren Apr 10, 2021, 4:29 PM

#

ah ok

sinful spade Apr 10, 2021, 4:29 PM

#

trill

lilac wren Apr 10, 2021, 4:30 PM

#

ugh I think I know

#

the gdmf Nonce changes every request it seems, so I have to have an appropriate response for that

#

with the same nonce

zealous bridge Apr 10, 2021, 4:31 PM

#

what on device changes the gdfm nonce anyway lmfao

celest basalt Apr 10, 2021, 4:31 PM

#

the device probably requests a new apnonce every time?

royal flint Apr 10, 2021, 4:31 PM

#

no iirc the gdmf nonce is just random

lilac wren Apr 10, 2021, 4:31 PM

#

idk if it's ap nonce, just a nonce for this request

royal flint Apr 10, 2021, 4:32 PM

#

yea

lilac wren Apr 10, 2021, 4:32 PM

#

probably doesn't have to do with anything else

celest basalt Apr 10, 2021, 4:32 PM

#

well usually when you do igetnonce in normal mode the apnonce doesn't change until a reboot, but the sepnonce changes on every request

zealous bridge Apr 10, 2021, 4:32 PM

#

yeah dont think the processor has anything to do with this

lilac wren Apr 10, 2021, 4:32 PM

#

^

#

But now I have to write some program to base64 encode some JSON with the requested nonce

zealous bridge Apr 10, 2021, 4:32 PM

#

probably an api nonce so apple dont get spammed or smth

royal flint Apr 10, 2021, 4:33 PM

#

yea nonce has no bearing

lilac wren Apr 10, 2021, 4:33 PM

#

Breakpoints Tool
The Breakpoints tool lets you intercept requests and responses before they are passed through Charles. You can examine and edit the request or response and then decide whether to allow it to proceed or to block it.

#

nice

zealous bridge Apr 10, 2021, 4:33 PM

#

lilac wren nice

i just did block list and it stopped it

royal flint Apr 10, 2021, 4:33 PM

#

i sent applepie to pallas and it gave me back applepie

zealous bridge Apr 10, 2021, 4:33 PM

#

but ig that works too

#

lmaooo

fickle kettle Apr 10, 2021, 4:33 PM

#

lilac wren still trying to remap the gdmf response, phone is rejecting it. There's a Date f...

u can use charles’s rewrite or make middle server is helpful

royal flint Apr 10, 2021, 4:34 PM

#

zealous bridge i just did block list and it stopped it

nah we're trying to rewrite the response

lilac wren Apr 10, 2021, 4:34 PM

#

royal flint i sent applepie to pallas and it gave me back applepie

LOL as the nonce?

royal flint Apr 10, 2021, 4:34 PM

#

lilac wren LOL as the nonce?

yup

lilac wren Apr 10, 2021, 4:34 PM

#

that's hilarious

celest basalt Apr 10, 2021, 4:34 PM

#

meanwhile here trying to get my device back to 14.3 from pwndfu but I keep failing lol

royal flint Apr 10, 2021, 4:34 PM

#

but yea, XML is the exact same so

lilac wren Apr 10, 2021, 4:35 PM

#

i can do this!! timeout seems to be long so I can edit the nonce live

zealous bridge Apr 10, 2021, 4:35 PM

#

RSEP is the restore sep protocol right? or is it something else

fickle kettle Apr 10, 2021, 4:35 PM

#

lilac wren i can do this!! timeout seems to be long so I can edit the nonce live

use rewrite response body

lilac wren Apr 10, 2021, 4:35 PM

#

yep

zealous bridge Apr 10, 2021, 4:36 PM

#

idk why does mine keep changing

#

weird

#

i have the same sep

fickle kettle Apr 10, 2021, 4:36 PM

#

i’ll make some ota cache server when i got jbable phone

lilac wren Apr 10, 2021, 4:36 PM

#

NO IM TOO SLOW

#

ugh

zealous bridge Apr 10, 2021, 4:37 PM

#

lmao

#

you are a 🐸 tbh

lilac wren Apr 10, 2021, 4:37 PM

#

because apple gdmf takes like an hour to respond

fickle kettle Apr 10, 2021, 4:37 PM

#

use this? https://www.charlesproxy.com/documentation/tools/rewrite/

Rewrite Tool • Charles Web Debugging Proxy

Charles Web Debugging Proxy - Official Site

#

regex replace supported

lilac wren Apr 10, 2021, 4:38 PM

#

oh ty

royal flint Apr 10, 2021, 4:39 PM

#

hmm wtf

fickle kettle Apr 10, 2021, 4:39 PM

#

or write simple web server and forward ur requests and change response

royal flint Apr 10, 2021, 4:39 PM

#

i can't see gdmf requests

#

but i can see mesu requests

lilac wren Apr 10, 2021, 4:39 PM

#

lol what

fickle kettle Apr 10, 2021, 4:39 PM

#

includes headers

royal flint Apr 10, 2021, 4:40 PM

#

#

lilac wren Apr 10, 2021, 4:41 PM

#

royal flint

enable ssl proxying

royal flint Apr 10, 2021, 4:41 PM

#

it is enabled

lilac wren Apr 10, 2021, 4:41 PM

#

on gdmf

royal flint Apr 10, 2021, 4:41 PM

#

that right click menu was on gdmf

lilac wren Apr 10, 2021, 4:41 PM

#

oh

#

the connection is still going maybe?

royal flint Apr 10, 2021, 4:41 PM

#

nop

lilac wren Apr 10, 2021, 4:41 PM

#

it's not a 200 ok, just 200 established

#

Mine show 200 OK

royal flint Apr 10, 2021, 4:42 PM

#

nah it's been like that for over 5 min

lilac wren Apr 10, 2021, 4:42 PM

#

hm

royal flint Apr 10, 2021, 4:42 PM

#

ill test on se

zealous bridge Apr 10, 2021, 4:42 PM

#

i had to do some thing where i added * to the list of ssl proxying enabled websites to make it work @royal flint

royal flint Apr 10, 2021, 4:42 PM

#

did that already

lilac wren Apr 10, 2021, 4:42 PM

#

fickle kettle use this? https://www.charlesproxy.com/documentation/tools/rewrite/

issue is I have to b64 encode the json response that I send to the device

royal flint Apr 10, 2021, 4:43 PM

#

lilac wren issue is I have to b64 encode the json response that I send to the device

also it might be signed

#

not sure

lilac wren Apr 10, 2021, 4:43 PM

#

ah

royal flint Apr 10, 2021, 4:43 PM

#

but there's some kind of cert thing in the first b64 chunk

lilac wren Apr 10, 2021, 4:43 PM

#

yeah true

royal flint Apr 10, 2021, 4:43 PM

#

I haven't checked if it changed with different resps

lilac wren Apr 10, 2021, 4:43 PM

#

Honestly might be easier to just make my own request with the nonce simultaneously

#

but i'm too slow lol

fickle kettle Apr 10, 2021, 4:44 PM

#

lol

royal flint Apr 10, 2021, 4:44 PM

#

Nah, just get the response manually, then edit it as you wish, then b64 encode, then paste it in when you need to rewrite

fickle kettle Apr 10, 2021, 4:44 PM

#

u can use this

#

https://www.charlesproxy.com/documentation/tools/map-local/

Map Local Tool • Charles Web Debugging Proxy

Charles Web Debugging Proxy - Official Site

#

emulate response to local file

lilac wren Apr 10, 2021, 4:45 PM

#

Gonna come back to this later, need to finish essay and eat

royal flint Apr 10, 2021, 4:45 PM

#

I'll start messing with this on my SE

#

blocking TSS should prevent any update from actually happening tho right?

#

because I don't wanna boot loop lmao

lilac wren Apr 10, 2021, 4:45 PM

#

fickle kettle https://www.charlesproxy.com/documentation/tools/map-local/

Thanks, but that's what I'm doing right now and I'm too slow to get the request, add the request 14.2 Param, request to gdmf myself, then put it into a file and map local

zealous bridge Apr 10, 2021, 4:46 PM

#

royal flint blocking TSS should prevent any update from actually happening tho right?

yeah

#

just block gs.apple.com

royal flint Apr 10, 2021, 4:46 PM

#

lilac wren Thanks, but that's what I'm doing right now and I'm too slow to get the request,...

But you don't need to redo getting the request every time, you can cache it and just change nonce as necessary

lilac wren Apr 10, 2021, 4:47 PM

#

I thought it was signed?

royal flint Apr 10, 2021, 4:47 PM

#

well have we confirmed that

#

im not 100% sure if it is

lilac wren Apr 10, 2021, 4:48 PM

#

Right now I'm literally trying to fake the normal response and can't even do that lol

fickle kettle Apr 10, 2021, 4:48 PM

#

lilac wren Thanks, but that's what I'm doing right now and I'm too slow to get the request,...

i think if u try only test change response part.
u need only 1 real response then u save the file and change contents emulating.

lilac wren Apr 10, 2021, 4:48 PM

#

fickle kettle i think if u try only test change response part. u need only 1 real response the...

Issue is the nonce changes every request

fickle kettle Apr 10, 2021, 4:48 PM

#

wrf

#

wtf..

#

ok try first. after fail u need forward server

#

and set charles’s map remote to ur local forward server

royal flint Apr 10, 2021, 4:50 PM

#

@fickle kettle is there a way to make charles automatically call an external program for the response

#

That way we can automate part of it

fickle kettle Apr 10, 2021, 4:50 PM

#

https://www.charlesproxy.com/documentation/tools/map-remote/

Map Remote Tool • Charles Web Debugging Proxy

Charles Web Debugging Proxy - Official Site

#

charles have useful tools

#

map remote forward match url rules to other servers

#

or simple way use mitmproxy and mitimproxy script

lilac wren Apr 10, 2021, 4:52 PM

#

royal flint <@333028850143592458> is there a way to make charles automatically call an exter...

Yeah what he said, map remote to your own server and pretend to be gdmf

fickle kettle Apr 10, 2021, 4:53 PM

#

oh mitm to mitmweb

royal flint Apr 10, 2021, 4:53 PM

#

lilac wren Yeah what he said, map remote to your own server and pretend to be gdmf

aight lemme check if resp is signed first

fickle kettle Apr 10, 2021, 4:53 PM

#

or very very simple way u can edit dns

#

sorry, cant speak eng well

royal flint Apr 10, 2021, 4:56 PM

#

it's ok we understand you well

radiant mountain Apr 10, 2021, 4:56 PM

#

royal flint That way it can't sneakily hit mesu without us knowing

Wait

#

Do we really need to know where supervised hit mesu ?

#

What are we looking for exactly ?

royal flint Apr 10, 2021, 4:58 PM

#

we already figured it out lol

#

mesu is the exact same

#

we found something else out though

#

we can get 14.2 from pallas

#

@lilac wren good news

#

not signed

radiant mountain Apr 10, 2021, 4:59 PM

#

Because, correct me if im wrong but... mesu is indeed cached or hidden or whatever on supervised... But not the ...apple-update/assets/ request, could we just let mesu do his thing, and track the update request to get the 14.3 url path ?

lilac wren Apr 10, 2021, 4:59 PM

#

royal flint not signed

Oh so we can just edit the b64 JSON between the two periods?

royal flint Apr 10, 2021, 4:59 PM

#

yee

lilac wren Apr 10, 2021, 5:00 PM

#

So we can learn, how did you figure this out

royal flint Apr 10, 2021, 5:00 PM

#

that it's not signed? made a bunch of different requests, first part was the same

#

also checked with https://jwt.io/ and it says invalid sig lol

JWT.IO

JSON Web Tokens are an open, industry standard RFC 7519 method for representing claims securely between two parties.

#

oh