美文网首页
libimobiledevice和lockdownd分析

libimobiledevice和lockdownd分析

作者: 超哥__ | 来源:发表于2021-10-03 18:54 被阅读0次

imobiledevice使用:
brew install libimobiledevice
命令:
idevice_id 获取设备udid
idevicebackup 备份还原 com.apple.mobilebackup
idevicebackup2 备份还原 com.apple.mobile.backup
idevicecrashreport 获取崩溃日志 com.apple.crashreportcopymobile
idevicedate 获取设备时间 special_case_get(TimeIntervalSince1970)
idevicedebug 调试App com.apple.mobile.debugserver com.apple.mobile.installation_proxy
idevicedebugserverproxy
idevicediagnostics
ideviceenterrecovery 进入恢复模式
ideviceimagemounter 挂载磁盘映像 com.apple.mobile.mobile_image_mounter
ideviceinfo 获取设备参数 handle_get_value
idevicename 获取设备名 special_case_getDeviceName)
idevicenotificationproxy操作推送
idevicepair
ideviceprovision 管理配置文件 com.apple.misagent
idevicescreenshot 截屏 com.apple.mobile.screenshotr
idevicesetlocation 模拟定位 com.apple.dt.simulatelocation
idevicesyslog 查看日志

ideviceimagemounter:
    umount /Developer # on iOS
    cd /Applications/Xcode.app/Contents/Developer/iPhoneOS.platform/Platforms/10.0
    ideviceimagemounter -d -t Developer DeveloperDiskImage.dmg DeveloperDiskImage.dmg.signature

    open_service_log_fd:
        Label = ideviceimagemounter
        Request = StartService
        Service = com.apple.mobile.mobile_image_mounter

    set Request = StartService
    get EscrowBag = nil
    set HostID = 02E3E0F1-833C-4237-EF57-B306B0E5B455
    set HostConnectionType = 1
    set HostIP = 127.0.0.1
    set HostSideClientName = idevicescreenshot
    get com.apple.mobile.debug-ForceHeartbeat = nil
    get com.apple.mobile.mobile_image_mounter = {
        AllowUnactivatedService = 1;
        Label = "com.apple.mobile.storage_mounter_proxy";
        XPCServiceName = "com.apple.mobile.storage_mounter_proxy";
    }
    get AllowUnactivatedService = 1
    get USBOnlyService = nil
    get InstanceLimit = nil
    get XPCServiceName = com.apple.mobile.storage_mounter_proxy
    get MultipleInstances = nil
    get Port = 49410
    get Error = nil

    /System/Library/LaunchDaemons:
        com.apple.mobile.storage_mounter_proxy.plist -> /usr/libexec/mobile_storage_proxy

        MobileStorageMounter
            A disk image of type <private>/(null) is already mounted at
            SecKeyRawVerify: Failed to verify the disk image signature(signature file invalid)
            System Version Mismatch for /Developer(/System/Library/CoreServices/SystemVersion.plist not match /Developer/System/Library/CoreServices/SystemVersion.plist in SystemVersion)
            Failed to verify the disk image mount path(/Developer not empty)


idevicescreenshort:
    open_service_log_fd:
        Label = idevicescreenshot
        Request = StartService
        Service = com.apple.mobile.screenshotr

    set Request = StartService
    get EscrowBag = nil
    set HostID = 02E3E0F1-833C-4237-EF57-B306B0E5B455
    set HostConnectionType = 1
    set HostIP = 127.0.0.1
    set HostSideClientName = idevicescreenshot
    get com.apple.mobile.debug-ForceHeartbeat = nil
    get com.apple.mobile.screenshotr = {
        AllowByProxy = 1;
        AllowUnactivatedService = 1;
        Label = "com.apple.mobile.screenshotr";
        ProgramArguments =     (
            "/Developer/usr/bin/ScreenShotr"
        );
    }
    get AllowUnactivatedService = 1
    get USBOnlyService = nil
    get InstanceLimit = nil
    get XPCServiceName = nil
    get ProgramArguments -> (
        "/Developer/usr/bin/ScreenShotr"
    )
    get UserName = nil
    get MultipleInstances = nil
    get Port = 49410
    get Error = nil

    SMJobSubmit:
        EnvironmentVariables =     {
            "LOCKDOWN_MACH_SERVICE" = "lockdown.55749159356.com.apple.mobile.screenshotr";
        };
        KeepAlive = 0;
        Label = "lockdown.55749159356.com.apple.mobile.screenshotr";
        LaunchOnlyOnce = 1;
        MachServices =     {
            "lockdown.55749159356.com.apple.mobile.screenshotr" = 1;
        };
        POSIXSpawnType = Interactive;
        ProgramArguments =     (
            "/Developer/usr/bin/ScreenShotr"
        );
        RunAtLoad = 0;
    
    handle_connection   ObjC.Object(args[0].add(8).readPointer().add(8).readPointer())
    {
        "com.apple.GPUTools.MobileService" =     {
            AllowByProxy = 1;
            Label = "com.apple.GPUTools.MobileService";
            ProgramArguments =         (
                "/Developer/usr/libexec/gputoolsd"
            );
        };
        "com.apple.PurpleReverseProxy.Conn" =     {
            AllowUnactivatedService = 1;
            Label = "com.apple.PurpleReverseProxy.Conn";
            UserName = mobile;
            XPCServiceName = "com.apple.PurpleReverseProxy.Conn";
        };
        "com.apple.PurpleReverseProxy.Ctrl" =     {
            AllowUnactivatedService = 1;
            Label = "com.apple.PurpleReverseProxy.Ctrl";
            UserName = mobile;
            XPCServiceName = "com.apple.PurpleReverseProxy.Ctrl";
        };
        "com.apple.accessibility.axAuditDaemon.remoteserver" =     {
            AllowByProxy = 1;
            Label = "com.apple.accessibility.axAuditDaemon.remoteserver";
            UserName = mobile;
            XPCServiceName = "com.apple.accessibility.axAuditDaemon.deviceservice.lockdown";
        };
        "com.apple.afc" =     {
            AllowUnactivatedService = 1;
            Label = "com.apple.afc";
            UserName = mobile;
            XPCServiceName = "com.apple.afcd";
        };
        "com.apple.atc" =     {
            Label = "com.apple.atc";
            UserName = mobile;
            XPCServiceName = "com.apple.atc";
        };
        "com.apple.atc2" =     {
            Label = "com.apple.atc2";
            UserName = mobile;
            XPCServiceName = "com.apple.atc2";
        };
        "com.apple.companion_proxy" =     {
            Label = "com.apple.companion_proxy";
            UserName = mobile;
            XPCServiceName = "com.apple.companion_proxy";
        };
        "com.apple.crashreportcopymobile" =     {
            AllowUnactivatedService = 1;
            Label = "com.apple.crashreportcopymobile";
            UserName = mobile;
            XPCServiceName = "com.apple.crashreportcopymobile";
        };
        "com.apple.crashreportmover" =     {
            AllowUnactivatedService = 1;
            Label = "com.apple.crashreportmover";
            XPCServiceName = "com.apple.crash_mover";
        };
        "com.apple.debugserver" =     {
            AllowByProxy = 1;
            Label = "com.apple.debugserver";
            ProgramArguments =         (
                "/Developer/usr/bin/debugserver",
                "--lockdown",
                "--launch=frontboard"
            );
            UserName = mobile;
        };
        "com.apple.debugserver.applist" =     {
            AllowByProxy = 1;
            Label = "com.apple.debugserver.applist";
            ProgramArguments =         (
                "/Developer/usr/bin/debugserver",
                "--lockdown",
                "--applist",
                "--launch=frontboard"
            );
            UserName = mobile;
        };
        "com.apple.dt.devicearbitration" =     {
            AllowByProxy = 1;
            Label = "com.apple.dt.devicearbitration";
            UserName = mobile;
            XPCServiceName = "com.apple.dt.devicearbitration";
        };
        "com.apple.dt.fetchsymbols" =     {
            Label = "com.apple.dt.fetchsymbols";
            ProgramArguments =         (
                "/Developer/Library/Daemons/DTFetchSymbols"
            );
        };
        "com.apple.dt.simulatelocation" =     {
            AllowByProxy = 1;
            Label = "com.apple.dt.simulatelocation";
            ProgramArguments =         (
                "/Developer/Library/Daemons/DTSimulateLocation"
            );
        };
        "com.apple.dt.xcodedevicemonitor" =     {
            AllowByProxy = 1;
            Label = "com.apple.dt.xcodedevicemonitor";
            ProgramArguments =         (
                "/Developer/usr/bin/XcodeDeviceMonitor",
                "--lockdown"
            );
            UserName = mobile;
        };
        "com.apple.idamd" =     {
            Label = "com.apple.idamd";
            UserName = mobile;
            XPCServiceName = "com.apple.idamd";
        };
        "com.apple.instruments.remoteserver" =     {
            AllowByProxy = 1;
            Label = "com.apple.instruments.remoteserver";
            UserName = root;
            XPCServiceName = "com.apple.instruments.deviceservice.lockdown";
        };
        "com.apple.iosdiagnostics.relay" =     {
            AllowUnactivatedService = 1;
            Label = "com.apple.iosdiagnostics.relay";
            ProgramArguments =         (
                "/usr/libexec/ios_diagnostics_relay"
            );
            UserName = mobile;
        };
        "com.apple.misagent" =     {
            Label = "com.apple.misagent";
            XPCServiceName = "com.apple.misagent";
        };
        "com.apple.mobile.MCInstall" =     {
            AllowUnactivatedService = 0;
            Label = "com.apple.mobile.MCInstall";
            ProgramArguments =         (
                "/usr/libexec/mc_mobile_tunnel"
            );
            UserName = mobile;
        };
        "com.apple.mobile.assertion_agent" =     {
            Label = "com.apple.mobile.assertion_agent";
            UserName = mobile;
            XPCServiceName = "com.apple.mobile.assertion_agent";
        };
        "com.apple.mobile.diagnostics_relay" =     {
            AllowUnactivatedService = 1;
            Label = "com.apple.mobile.diagnostics_relay";
            ProgramArguments =         (
                "/usr/libexec/mobile_diagnostics_relay"
            );
        };
        "com.apple.mobile.file_relay" =     {
            Label = "com.apple.mobile.file_relay";
            XPCServiceName = "com.apple.mobile.file_relay";
        };
        "com.apple.mobile.heartbeat" =     {
            Label = "HeartBeat Monitor";
            UserName = mobile;
            XPCServiceName = "com.apple.mobile.heartbeat";
        };
        "com.apple.mobile.house_arrest" =     {
            InstanceLimit = 5;
            Label = "com.apple.mobile.house_arrest";
            MultipleInstances = 1;
            UserName = mobile;
            XPCServiceName = "com.apple.mobile.house_arrest";
        };
        "com.apple.mobile.insecure_notification_proxy" =     {
            AllowUnactivatedService = 1;
            Label = "com.apple.mobile.insecure_notification_proxy";
            UserName = mobile;
            XPCServiceName = "com.apple.mobile.insecure_notification_proxy";
        };
        "com.apple.mobile.installation_proxy" =     {
            Label = "com.apple.mobile.installation_proxy";
            UserName = mobile;
            XPCServiceName = "com.apple.mobile.installation_proxy";
        };
        "com.apple.mobile.mobile_image_mounter" =     {
            AllowUnactivatedService = 1;
            Label = "com.apple.mobile.storage_mounter_proxy";
            XPCServiceName = "com.apple.mobile.storage_mounter_proxy";
        };
        "com.apple.mobile.notification_proxy" =     {
            AllowUnactivatedService = 1;
            Label = "com.apple.mobile.notification_proxy";
            UserName = mobile;
            XPCServiceName = "com.apple.mobile.notification_proxy";
        };
        "com.apple.mobile.screenshotr" =     {
            AllowByProxy = 1;
            AllowUnactivatedService = 1;
            Label = "com.apple.mobile.screenshotr";
            ProgramArguments =         (
                "/Developer/usr/bin/ScreenShotr"
            );
        };
        "com.apple.mobileactivationd" =     {
            AllowUnactivatedService = 1;
            Label = "com.apple.mobileactivationd";
            UserName = mobile;
            XPCServiceName = "com.apple.mobileactivationd.lockdown";
        };
        "com.apple.mobilebackup" =     {
            InstanceLimit = 5;
            Label = "com.apple.mobilebackup";
            ProgramArguments =         (
                "/usr/libexec/BackupAgent",
                "--lockdown"
            );
        };
        "com.apple.mobilebackup2" =     {
            InstanceLimit = 5;
            Label = "com.apple.mobilebackup2";
            ProgramArguments =         (
                "/usr/libexec/BackupAgent2",
                "--lockdown"
            );
        };
        "com.apple.mobilesync" =     {
            InstanceLimit = 5;
            Label = "com.apple.mobilesync";
            ProgramArguments =         (
                "/usr/libexec/SyncAgent",
                "--lockdown",
                "--oneshot",
                "-v"
            );
            UserName = mobile;
        };
        "com.apple.os_trace_relay" =     {
            AllowUnactivatedService = 1;
            Label = "com.apple.syslog_relay";
            UserName = mobile;
            XPCServiceName = "com.apple.os_trace_relay";
        };
        "com.apple.pcapd" =     {
            AllowUnactivatedService = 1;
            InstanceLimit = 1;
            Label = "com.apple.pcapd";
            ProgramArguments =         (
                "/usr/libexec/pcapd"
            );
            USBOnlyService = 1;
        };
        "com.apple.preboardservice" =     {
            Label = "com.apple.preboardservice";
            UserName = mobile;
            XPCServiceName = "com.apple.preboardservice";
        };
        "com.apple.preboardservice_v2" =     {
            AllowUnactivatedService = 1;
            Label = "com.apple.preboardservice_v2";
            UserName = mobile;
            XPCServiceName = "com.apple.preboardservice_v2";
        };
        "com.apple.springboardservices" =     {
            Label = "com.apple.springboardservicesrelay";
            ProgramArguments =         (
                "/usr/libexec/springboardservicesrelay"
            );
            UserName = mobile;
        };
        "com.apple.streaming_zip_conduit" =     {
            Label = "com.apple.streaming_zip_conduit";
            UserName = mobile;
            XPCServiceName = "com.apple.streaming_zip_conduit";
        };
        "com.apple.syslog_relay" =     {
            AllowUnactivatedService = 1;
            Label = "com.apple.syslog_relay";
            UserName = mobile;
            XPCServiceName = "com.apple.syslog_relay";
        };
        "com.apple.testmanagerd.lockdown" =     {
            AllowByProxy = 1;
            Label = "com.apple.testmanagerd.lockdown";
            UserName = mobile;
            XPCServiceName = "com.apple.testmanagerd.lockdown";
        };
        "com.apple.testmanagerd.remote-automation.lockdown" =     {
            AllowByProxy = 1;
            Label = "com.apple.testmanagerd.remote-automation.lockdown";
            UserName = mobile;
            XPCServiceName = "com.apple.testmanagerd.remote-automation.lockdown";
        };
        "com.apple.webinspector" =     {
            Label = "com.apple.webinspector";
            UserName = mobile;
            XPCServiceName = "com.apple.webinspector";
        };
    }

跟踪lockdownd:

    /private/var/logs/lockdownd.log
    lockdownd port=62078 ssl_enabled=0

    CFPropertyListCreateWithData    lockdownd读
    CFPropertyListCreateData        lockdownd写

    RequestGoodbye                  = 1
    RequestQueryType                = 2
    RequestGetValue                 = 3
    RequestGetValueCU               = 4
    RequestSetValue                 = 5
    RequestRemoveValue              = 6
    RequestPair                     = 7
    RequestPairCU                   = 8
    RequestUnpair                   = 9
    RequestResetParing              = 10
    RequestStartSession             = 11
    RequestStopSession              = 12
    RequestStartService             = 13
    RequestEnterRecovery            = 14
    RequestSaveValue                = 15
    RequestIsHostTrusted            = 16
    RequestEnableWirelessPairing    = 17
    RequestCUPairingCreate          = 18
    RequestCUPairingVerify          = 19

相关文章

网友评论

      本文标题:libimobiledevice和lockdownd分析

      本文链接:https://www.haomeiwen.com/subject/xwhbnltx.html