diff options
Diffstat (limited to 'src')
-rw-r--r-- | src/iphone.c | 59 | ||||
-rw-r--r-- | src/lockdown.c | 201 | ||||
-rw-r--r-- | src/lockdown.h | 1 | ||||
-rw-r--r-- | src/usbmux.c | 3 | ||||
-rw-r--r-- | src/utils.c | 32 |
5 files changed, 282 insertions, 14 deletions
diff --git a/src/iphone.c b/src/iphone.c index 32d27f6..1f68180 100644 --- a/src/iphone.c +++ b/src/iphone.c @@ -28,6 +28,49 @@ #include <stdlib.h> #include <string.h> +/** + * This function sets the configuration of the given device to 3 + * and claims the interface 1. If usb_set_configuration fails, it detaches + * the kernel driver that blocks the device, and retries configuration. + * + * @param phone which device to configure + */ +static void iphone_config_usb_device(iphone_device_t phone) +{ + int ret; + + log_debug_msg("setting configuration... "); + ret = usb_set_configuration(phone->device, 3); + if (ret != 0) { + log_debug_msg("Hm, usb_set_configuration returned %d: %s, trying to fix:\n", ret, strerror(-ret)); + log_debug_msg("-> detaching kernel driver... "); + ret = + usb_detach_kernel_driver_np(phone->device, + phone->__device->config->interface->altsetting->bInterfaceNumber); + if (ret != 0) { + log_debug_msg("usb_detach_kernel_driver_np returned %d: %s\n", ret, strerror(-ret)); + } else { + log_debug_msg("done.\n"); + log_debug_msg("setting configuration again... "); + ret = usb_set_configuration(phone->device, 3); + if (ret != 0) { + log_debug_msg("Error: usb_set_configuration returned %d: %s\n", ret, strerror(-ret)); + } else { + log_debug_msg("done.\n"); + } + } + } else { + log_debug_msg("done.\n"); + } + + log_debug_msg("claiming interface... "); + ret = usb_claim_interface(phone->device, 1); + if (ret != 0) { + log_debug_msg("Error: usb_claim_interface returned %d: %s\n", ret, strerror(-ret)); + } else { + log_debug_msg("done.\n"); + } +} /** * Given a USB bus and device number, returns a device handle to the iPhone on @@ -73,8 +116,7 @@ static iphone_error_t iphone_get_specific_device(unsigned int bus_n, int dev_n, if (dev->devnum == dev_n) { phone->__device = dev; phone->device = usb_open(phone->__device); - usb_set_configuration(phone->device, 3); - usb_claim_interface(phone->device, 1); + iphone_config_usb_device(phone); goto found; } @@ -115,9 +157,10 @@ static iphone_error_t iphone_get_specific_device(unsigned int bus_n, int dev_n, return IPHONE_E_SUCCESS; } else { // Bad header + log_debug_msg("get_iPhone(): Received a bad header/invalid version number.\n"); + log_debug_buffer((char *) version, sizeof(*version)); iphone_free_device(phone); free(version); - log_debug_msg("get_iPhone(): Received a bad header/invalid version number."); return IPHONE_E_BAD_HEADER; } @@ -173,13 +216,21 @@ iphone_error_t iphone_free_device(iphone_device_t device) if (!device) return IPHONE_E_INVALID_ARG; iphone_error_t ret = IPHONE_E_UNKNOWN_ERROR; + int bytes; + unsigned char buf[512]; + + // read final package + bytes = usb_bulk_read(device->device, BULKIN, (void *) &buf, 512, 1000); + if (bytes > 0) { + log_debug_msg("iphone_free_device: final read returned\n"); + log_debug_buffer(buf, bytes); + } if (device->buffer) { free(device->buffer); } if (device->device) { usb_release_interface(device->device, 1); - usb_reset(device->device); usb_close(device->device); ret = IPHONE_E_SUCCESS; } diff --git a/src/lockdown.c b/src/lockdown.c index c6d5f80..872b7b0 100644 --- a/src/lockdown.c +++ b/src/lockdown.c @@ -65,6 +65,104 @@ iphone_lckd_client_t new_lockdownd_client(iphone_device_t phone) return control; } +/** + * Closes the lockdownd communication session, by sending + * the StopSession Request to the device. + * + * @param control The lockdown client + */ +static void iphone_lckd_stop_session(iphone_lckd_client_t control) +{ + if (!control) + return; //IPHONE_E_INVALID_ARG; + + int bytes = 0, i = 0; + iphone_error_t ret = IPHONE_E_UNKNOWN_ERROR; + + plist_t dict = plist_new_dict(); + plist_add_sub_element(dict, PLIST_KEY, (void *) "Request", strlen("Request")); + plist_add_sub_element(dict, PLIST_STRING, (void *) "StopSession", strlen("StopSession")); + plist_add_sub_element(dict, PLIST_KEY, (void *) "SessionID", strlen("SessionID")); + plist_add_sub_element(dict, PLIST_STRING, (void *) control->session_id, strlen(control->session_id)); + + log_debug_msg("iphone_lckd_stop_session() called\n"); + char *XML_content = NULL; + uint32_t length = 0; + + plist_to_xml(dict, &XML_content, &length); + log_debug_msg("Send msg :\nsize : %i\nxml : %s", length, XML_content); + ret = iphone_lckd_send(control, XML_content, length, &bytes); + + free(XML_content); + XML_content = NULL; + plist_free(dict); + dict = NULL; + + ret = iphone_lckd_recv(control, &XML_content, &bytes); + log_debug_msg("Receive msg :\nsize : %i\nxml : %s", bytes, XML_content); + plist_from_xml(XML_content, bytes, &dict); + + if (!dict) { + log_debug_msg("lockdownd_stop_session(): IPHONE_E_PLIST_ERROR\n"); + return; // IPHONE_E_PLIST_ERROR; + } + + plist_t query_node = plist_find_node(dict, PLIST_STRING, "StopSession", strlen("StopSession")); + plist_t result_node = plist_get_next_sibling(query_node); + plist_t value_node = plist_get_next_sibling(result_node); + + plist_type result_type; + plist_type value_type; + + char *result_value = NULL; + char *value_value = NULL; + uint64_t result_length = 0; + uint64_t value_length = 0; + + plist_get_type_and_value(result_node, &result_type, (void *) (&result_value), &result_length); + plist_get_type_and_value(value_node, &value_type, (void *) (&value_value), &value_length); + + if (result_type == PLIST_KEY && + value_type == PLIST_STRING && !strcmp(result_value, "Result") && !strcmp(value_value, "Success")) { + log_debug_msg("lockdownd_stop_session(): success\n"); + ret = IPHONE_E_SUCCESS; + } + + return; // ret; +} + + +/** + * Shuts down the SSL session by first calling iphone_lckd_stop_session + * to cleanly close the lockdownd communication session, and then + * performing a close notify, which is done by "gnutls_bye". + * + * @param client The lockdown client + */ +static void iphone_lckd_stop_SSL_session(iphone_lckd_client_t client) +{ + if (!client) { + log_debug_msg("lockdownd_stop_SSL_session(): invalid argument!\n"); + return; + } + + if (client->in_SSL) { + log_debug_msg("Stopping SSL Session\n"); + iphone_lckd_stop_session(client); + log_debug_msg("Sending SSL close notify\n"); + gnutls_bye(*client->ssl_session, GNUTLS_SHUT_RDWR); + } + if (client->ssl_session) { + gnutls_deinit(*client->ssl_session); + free(client->ssl_session); + } + client->in_SSL = 0; + client->gtls_buffer_hack_len = 0; // dunno if required?! + + return; +} + + /** Closes the lockdownd client and does the necessary housekeeping. * * @param control The lockdown client @@ -75,13 +173,17 @@ iphone_error_t iphone_lckd_free_client(iphone_lckd_client_t client) return IPHONE_E_INVALID_ARG; iphone_error_t ret = IPHONE_E_UNKNOWN_ERROR; + iphone_lckd_stop_SSL_session(client); + if (client->connection) { + lockdownd_close(client); + + // IMO, read of final "sessionUpcall connection closed" packet + // should come here instead of in iphone_free_device + ret = iphone_mux_free_client(client->connection); } - if (client->ssl_session) - gnutls_deinit(*client->ssl_session); - free(client->ssl_session); free(client); return ret; } @@ -512,6 +614,70 @@ iphone_error_t lockdownd_pair_device(iphone_lckd_client_t control, char *uid, ch return ret; } +/** + * Performs the Goodbye Request to tell the device the communication + * session is now closed. + * + * @param control The lockdown client + */ +void lockdownd_close(iphone_lckd_client_t control) +{ + if (!control) + return; //IPHONE_E_INVALID_ARG; + + int bytes = 0, i = 0; + iphone_error_t ret = IPHONE_E_UNKNOWN_ERROR; + + plist_t dict = plist_new_dict(); + plist_add_sub_element(dict, PLIST_KEY, (void *) "Request", strlen("Request")); + plist_add_sub_element(dict, PLIST_STRING, (void *) "Goodbye", strlen("Goodbye")); + + log_debug_msg("lockdownd_close() called\n"); + char *XML_content = NULL; + uint32_t length = 0; + + plist_to_xml(dict, &XML_content, &length); + log_debug_msg("Send msg :\nsize : %i\nxml : %s", length, XML_content); + ret = iphone_lckd_send(control, XML_content, length, &bytes); + + free(XML_content); + XML_content = NULL; + plist_free(dict); + dict = NULL; + + ret = iphone_lckd_recv(control, &XML_content, &bytes); + log_debug_msg("Receive msg :\nsize : %i\nxml : %s", bytes, XML_content); + plist_from_xml(XML_content, bytes, &dict); + + if (!dict) { + log_debug_msg("lockdownd_close(): IPHONE_E_PLIST_ERROR\n"); + return; // IPHONE_E_PLIST_ERROR; + } + + plist_t query_node = plist_find_node(dict, PLIST_STRING, "Goodbye", strlen("Goodbye")); + plist_t result_node = plist_get_next_sibling(query_node); + plist_t value_node = plist_get_next_sibling(result_node); + + plist_type result_type; + plist_type value_type; + + char *result_value = NULL; + char *value_value = NULL; + uint64_t result_length = 0; + uint64_t value_length = 0; + + plist_get_type_and_value(result_node, &result_type, (void *) (&result_value), &result_length); + plist_get_type_and_value(value_node, &value_type, (void *) (&value_value), &value_length); + + if (result_type == PLIST_KEY && + value_type == PLIST_STRING && !strcmp(result_value, "Result") && !strcmp(value_value, "Success")) { + log_debug_msg("lockdownd_close(): success\n"); + ret = IPHONE_E_SUCCESS; + } + + return; // ret; +} + /** Generates the device certificate from the public key as well as the host * and root certificates. * @@ -654,6 +820,7 @@ iphone_error_t lockdownd_start_SSL_session(iphone_lckd_client_t control, const c uint32_t length = 0, bytes = 0, return_me = 0; iphone_error_t ret = IPHONE_E_UNKNOWN_ERROR; + control->session_id[0] = '\0'; /* Setup DevicePublicKey request plist */ dict = plist_new_dict(); @@ -699,7 +866,7 @@ iphone_error_t lockdownd_start_SSL_session(iphone_lckd_client_t control, const c XML_content = NULL; plist_free(dict); dict = NULL; - + ret = IPHONE_E_SSL_ERROR; if (result_key_type == PLIST_KEY && result_value_type == PLIST_STRING && !strcmp(result_key, "Result") && !strcmp(result_value, "Success")) { // Set up GnuTLS... @@ -749,12 +916,34 @@ iphone_error_t lockdownd_start_SSL_session(iphone_lckd_client_t control, const c return IPHONE_E_SSL_ERROR; } else { control->in_SSL = 1; - return IPHONE_E_SUCCESS; + ret = IPHONE_E_SUCCESS; } } + //store session id + plist_t session_node = plist_find_node(dict, PLIST_KEY, "SessionID", strlen("SessionID")); + if (session_node) { + + plist_type session_node_val_type; + char *session_id = NULL; + uint64_t session_id_length = 0; + plist_t session_node_val = plist_get_next_sibling(session_node); + + plist_get_type_and_value(session_node_val, &session_node_val_type, (void *) (&session_id), + &session_id_length); + if (session_node_val_type == PLIST_STRING && session_id_length > 0) { + // we need to store the session ID for StopSession + strcpy(control->session_id, session_id); + log_debug_msg("SessionID: %s\n", control->session_id); + return ret; + } + } + + if (ret == IPHONE_E_SUCCESS) { + log_debug_msg("Failed to get SessionID!\n"); + return ret; + } log_debug_msg("Apparently failed negotiating with lockdownd.\n"); - log_debug_msg("Responding dictionary: \n"); return IPHONE_E_SSL_ERROR; } else { log_debug_msg("Didn't get enough bytes.\n"); diff --git a/src/lockdown.h b/src/lockdown.h index 8ca8a7f..cdc46b8 100644 --- a/src/lockdown.h +++ b/src/lockdown.h @@ -37,6 +37,7 @@ struct iphone_lckd_client_int { int in_SSL; char *gtls_buffer_hack; int gtls_buffer_hack_len; + char session_id[40]; }; iphone_lckd_client_t new_lockdownd_client(iphone_device_t phone); diff --git a/src/usbmux.c b/src/usbmux.c index 427b880..eb7ec97 100644 --- a/src/usbmux.c +++ b/src/usbmux.c @@ -182,8 +182,11 @@ iphone_error_t iphone_mux_free_client(iphone_umux_client_t client) return IPHONE_E_INVALID_ARG; client->header->tcp_flags = 0x04; + client->header->length = htonl(0x1C); client->header->scnt = htonl(client->header->scnt); client->header->ocnt = htonl(client->header->ocnt); + client->header->window = 0; + client->header->length16 = htons(0x1C); int bytes = 0; bytes = usb_bulk_write(client->phone->device, BULKOUT, (char *) client->header, sizeof(usbmux_tcp_header), 800); diff --git a/src/utils.c b/src/utils.c index ceb1f5d..fb98471 100644 --- a/src/utils.c +++ b/src/utils.c @@ -56,11 +56,35 @@ void log_debug_msg(const char *format, ...) inline void log_debug_buffer(const char *data, const int length) { #ifndef STRIP_DEBUG_CODE + int i; + int j; + unsigned char c; - /* run the real fprintf */ - if (toto_debug) - fwrite(data, 1, length, stderr); - + if (toto_debug) { + for (i = 0; i < length; i += 16) { + fprintf(stderr, "%04x: ", i); + for (j = 0; j < 16; j++) { + if (i + j >= length) { + fprintf(stderr, " "); + continue; + } + fprintf(stderr, "%02hhx ", *(data + i + j)); + } + fprintf(stderr, " | "); + for (j = 0; j < 16; j++) { + if (i + j >= length) + break; + c = *(data + i + j); + if ((c < 32) || (c > 127)) { + fprintf(stderr, "."); + continue; + } + fprintf(stderr, "%c", c); + } + fprintf(stderr, "\n"); + } + fprintf(stderr, "\n"); + } #endif } |