Skip to content

stealth: deep-walk plist + dump shape on missing keys#10

Merged
Evil0ctal merged 1 commit into
mainfrom
feat/m5b-stealth-key-hunt
May 6, 2026
Merged

stealth: deep-walk plist + dump shape on missing keys#10
Evil0ctal merged 1 commit into
mainfrom
feat/m5b-stealth-key-hunt

Conversation

@Evil0ctal
Copy link
Copy Markdown
Owner

what

real-device m5a probe on iOS 15.8 returned:

  • path A — "fileFormatChanged(path: "accountsd:storefront")"
    — DSID was found but no storefront in any KVC parent we tried
  • path B — "fileFormatChanged(path: "/var/.../accountInfo")"
    — file opened, parsed, but our top-level key candidates didn't match
  • path C — confused entitlementDenied for empty match set

m5b makes the next probe actually informative.

changes

  • FileSystemImporter walks the plist recursively; case-insensitive
    match across an expanded candidate list per role
  • on miss, the error embeds the plist shape (keys + types, no values)
    • which roles are missing — pastable into a diagnostic report
  • AccountsdBridge searches storefront in properties + accountProperties
    • userInfo + options + direct KVC + credential.properties
  • KeychainImporter distinguishes errSecMissingEntitlement from a status=0
    empty match set so error labels are accurate

test

  • xcodebuild Debug + Release archive both green, lint clean
  • on real device: re-probe shows either ok (success) or a fileFormatChanged
    error containing the actual plist shape

m5a told us path B fails with fileFormatChanged but not which key was
missing or what was actually present. real-device probe on ios 15.8
returned exactly that opaque error.

* FileSystemImporter recursive walk through nested dicts/arrays. apple
  reshuffles plist layout across ios majors, top-level lookup is too
  brittle.
* expanded candidate key list per role (dsid/storefront/guid/email/...)
* on miss, the error path now embeds the plist shape summary
  (key:type pairs, no values) and which fields are missing — pasteable
  back into a diagnostic without leaking secrets.
* AccountsdBridge searches storefront across properties + accountProperties
  + userInfo + options + direct KVC + credential.properties — stale ios
  15 KVC paths only put it on credential.properties, which we missed.
* KeychainImporter splits errSecMissingEntitlement (-34018) from generic
  status=0+empty-array (no items), so "entitlementDenied" actually means
  what it says.
@Evil0ctal Evil0ctal merged commit 5b48275 into main May 6, 2026
3 checks passed
@Evil0ctal Evil0ctal deleted the feat/m5b-stealth-key-hunt branch May 6, 2026 01:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant