-
Notifications
You must be signed in to change notification settings - Fork 1.4k
idevicedebug iOS 13 #793
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Comments
@nikias, In iOS 13, most of the services require an extra SSL handshake once the service socket is connected (not just for the startService in lockdown client). I think this is the cause here too. |
What do you mean by "extra SSL handshake"? |
Lockdown return an extra key in response to StartService - EnableServiceSSL. When it is true, an SSL handshake is required on the new service socket after usbmuxd Connect. |
@EliyahuStern but this is actually implemented here: |
@nikias you are right, missed that somehow. I will take another look... |
I believe they switched to TLS 1.3 for ssl |
@umutuzgur what makes you think that? I am able to successfully complete TLS handshake with protocol version 3.3 (TLS 1.2). The Wired thing is, it seems like after the handshake is complete, some services (including debugserver) switch back to plain-text. No clue how to tell in runtime if SSL needs to be disabled or not after handshake though. |
Are you able to read the service response by service_receive function on the SSL handshaked connection at all? (SSL or textual) |
Yes, it looks like most services beyond the lockdown service require EnableSSL now. But once the handshake is performed, with the current code, the data is not encrypted. Some services do encrypt the but not all. |
The service and client negotiate the cipher and if they don't agree the handshake would fail. So not sure how that would make sense. Do we have any proof/dump that shows that despite the successful handshake it would then continue in plain text? From my understanding it just stalls. Also which other services except debugserver don't work (after the most recent commits)? What services don't use SSL? From what I can tell all are forced to use SSL now. |
That's really odd. I've looked at the Instruments service ( So apart from some services now requiring a SSL handshake where they apparently did not require one before, I don't see much of a difference. @JonGabilondoAngulo You seem to be saying that you are observing services which require continued communication over SSL. Which services are that? Do you have any traces you could share? |
I pushed a fix in 7c00b36. |
I was working on "com.apple.instruments.remoteserver" as well, and as you say after the SLL_do_handshake the service returns plain text. I thought maybe it was some NULL cipher stuff. But I'll check nikias' last push it seems promising. |
It looks like some services need the SSL_Handshake just for the start, then they go on without encryption. I guess some Apple teams did not get in time to iOS13 to make the communication encrypted, in the case of debugserver, being open source, maybe it will be not SSL for a while. Anyhow I get better results in other services if instead of doing a "service_disable_ssl" I do force to read/write instead of SSL_read/write. Implementing some kind of "service_bypass_ssl(parent)" ( instead of "service_disable_ssl(parent)" ), that will make "idevice_connection_receive_timeout" to jump to "internal_connection_receive_timeout" instead of doing the SSL transmission : "int r = SSL_read(connection->ssl_data->session, (void*)((char*)(data+received)), (int)len-received);" I think something in this direction will make libimobiledevice more close to what really happens with the ios services.
|
Hey guys - I have been looking at the instruments service too <com.apple.instruments.remoteserver> after implementing some of the suggestions mentioned above by @JonGabilondoAngulo. I am getting strange results. Following are the steps I have taken.
Have you proceeded beyond this @qmfrederik or @JonGabilondoAngulo ? |
Also, are you guys using the latest commit from master or are you using a stable release (a.ka 1.2.0)? |
Ok - upon doing some more investigation. It looks like I get to read the first message unencrypted without an issue. After that, I get an SSL record(message) I think, the first three bytes are 0x15, 0x3, 0x1. And the next two bytes are 0x0 and 0x20. From the SSL Record format, it looks like the first byte denotes the type of message - 0x15 is an alert in this case. The next two bytes denote the version of SSL being used and the last two bytes are the size of the message. I am using release 1.2.0 of libimobiledevice and haven't updated to the latest code in the master branch. So, one of the two could be happening, (speculation)
Any ideas? |
This sequence works:
If you stop or pause debugging at some step then you will get the SSL message you mention, probably some disconnection. MESSAGE. Size:37 |
@karthikgbbristol can you keep reading plaintext after receiving the alert? This is of course a speculation, since the alert itself is encrypted and I can't tell its contents (could not reproduce it myself yet). |
@JonGabilondoAngulo I am pretty sure that's the scenario I am using now. But after I send a message to open a channel, I get the SSL Alert which upon more investigation is a SSL_SHUTDOWN. I will try and read the 37 bytes of this message first to see if the host can proceed unencrypted as suggested by @EliyahuStern. |
I can go on to open a channel, ask for process id, launch apps .. no problem of disconnection. |
By the way this is another problem, I don't know if it related to what you see. |
@JonGabilondoAngulo . Which particular service are you using? I will try using the latest version of libimobiledevice and libusbmuxd and recreate my test. I have tried the mod you suggested in #807 too. But that's an issue related to timeout and I don't think it helped. |
I have updated to the latest code from libimobiledevice and libusbmuxd and still get the SSL SHUTDOWN. Following is the sequence of calls I make (I have written a stub program that just reads the capability message using the bypass, then sends a simple command (another request for capabilities) and reads the response. When reading the response I always get a SSL SHUTDOWN message. Fails every time on my iPhone 6s Plus.
And this is the part for creating a new client, just like some of the other services.
@JonGabilondoAngulo anything you can see that I am doing incorrectly? Btw the bypas code is in here (idevice.c)
|
@JonGabilondoAngulo Never mind fixed it - Silly mistake as usual. Realised that I had bypassed only receive and not send. Now added bypass to send as well and it works now. SO previously it was sending using SSL write and that might be the reason for the SSL_SHUTDOWN reply. |
@nikias @JonGabilondoAngulo @karthikgbbristol |
@maznikoff What issues are you facing - As I mentioned about, as long as you ensure that both send and receive use usbmuxd_send/usbmuxd_receive, it should work. I have had iOS 13 working the last couple of weeks. |
@karthikgbbristol may be I don't understand something or did something incorrectly but in my case I could not start application using idevicedebug. I tried the code written above but it changed nothing. Also compared responses which sends me debugserver on iOS 12 and 13. iOS 12: What is the 'a' and '7' that I receive on iOS 13? What's error 02? |
@nikias asked "Also which other services except debugserver don't work (after the most recent commits)? What services don't use SSL? From what I can tell all are forced to use SSL now." |
hi, |
@dkimitsa Thanks! I just tested your patch in the windows build, and it works indeed! |
Hi, |
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
Could you please show how you realize the function "instruments_receive" ? @karthikgbbristol |
@anshumanchatterji using an Ubuntu 18.04.3 LTS I'm not able to launch an app in debug mode in iOS 13.3. What is your setup and iOS version ? |
@hduarte The libimobiledevice version included in Ubuntu 18.04 is pretty old (AFAIR from 2017). At the moment you need the latest version from master from iOS 13. Be aware that simply cloning libimobiledevice and compiling it will not work because also a lot of dependencies are too old to compile the latest version of libimobiledevice. Additionally updating all dependencies and compiling+using the latest master branch may not be sufficient as there is a bug in this version (see #872 for details) that affected idevicedebug. |
if i remember correctly, to launch app in debug mode (with debugger attached), you need first mount developer support image for ios. |
@mexmer mounting 13.2 does work, actually Xcode does same. |
@mexmer The 13.2 images work fine in my environment. Xcode also seem to use them as debugging via Xcode works with 13.3 devices and there are no other developer images accessible to Xcode. |
for me it throws error when i try to mount 13.2 image on my 13.3 ipad air 2 |
xcode beta now has images for 13.3 and 13.4 |
@JonGabilondoAngulo any luck starting the com.apple.instruments.remoteserver service on iOS14 devices. I am getting an INVALID_SERVICE error fwhen trying to start the lockdown service. |
Just wondering if there's any chance that @JonGabilondoAngulo, @karthikgbbristol or others would be able to share their implementation of communication with com.apple.instruments.remoteserver anywhere. I'm sure it would be greatly appreciated by many people. |
Unfortunately, something was broken with iOS 13b1 release. Tried to perform 'idevicedebug run bundle_id' and got:
Jun 4 12:34:15 iPhone debugserver[417] : debugserver will use ASL for internal logging.
Jun 4 12:34:15 iPhone debugserver[417] : debugserver-@(#)PROGRAM:LLDB PROJECT:lldb-900.3.96
for arm64.
Jun 4 12:34:15 iPhone debugserver[417] : Connecting to com.apple.debugserver service...
Jun 4 12:34:15 iPhone trustd[153] : cert[0]: AnchorTrusted =(leaf)[force]> 0
Jun 4 12:34:15 iPhone trustd[153] : cert[0]: NonEmptySubject =(path)[]> 0
Jun 4 12:34:15 iPhone debugserver[417] : Got a connection, waiting for process information for launching or attaching.
Jun 4 12:34:15 iPhone lockdownd[67] : spawn_xpc_service_block_invoke:
Jun 4 12:34:15 iPhone lockdownd[67] : spawn_xpc_service_block_invoke:
Jun 4 12:34:15 iPhone debugserver[417] : error: packet read thread exited.
Jun 4 12:34:15 iPhone debugserver[417] : Exiting.
The text was updated successfully, but these errors were encountered: