The scripts require a jailbroken iPhone, paired with an AirTag, and a host system, running FЯIDA.
AirTag support was introduced as of iOS 14.5. So far, we tested the scripts provided here on various iOS versions (14.6, 14.7, 14.8) on checkm8-supported devices. The scripts might run on Fugu14 as well, but we didn't test that yet.
Use hook_durian.js to play custom sounds aka AirTechno, and also run and decode all other L2CAP commands. Commands are described by opcodes, and opcodes can be enumerated to list their meanings.
It's possible to run raw commands. However, some commands require a mutex or special
state. Thus, ideally, create a task, which will take care of creating a command,
including mutex handling. Objective-C allows to extract a full command list, included
in the comments of hook_durian.js, so that you don't need to enumerate them.
For example, unpairTask, stopSoundTask, etc.
// run a predefined task
d.performTaskByName('stopSoundTask');
// run a task with custom opcode 0x01 and payload 0x02030405
d.performTaskWithCommand([1, 2, 3, 4, 5]);Some tasks require parameters. These aren't fully reverse engineered yet. Depending on the command, you might need to add a custom function. For example, you can play custom sounds:
// play sound sequence id 1, twice, with 0 offset, and 0 pause
d.playSoundSequence[1, 2, 0, 0];To set the DurianService etc. to call task, manually play a sound
via the Find My app on the AirTag once.
A detailed description of the downgrade process including script explanations is available on YouTube.
The iPhone Wiki hosts an up-to-date list of all firmware updates released for the AirTag. Note that the very first stock version (1.0.225) was never released as OTA, so you cannot use the method here to downgrade to the very first version that did not have any anti-stalking protections.
If you want to downgrade the U1 firmware as well, you can extract it using DurianFirmware_extract.py.
mkdir airtag_firmware_1A276d
cd airtag_firmware_1A276d
wget https://updates.cdn-apple.com/2021/patches/071-45785/4132D4FE-1C5A-498E-8A6D-678A026679AF/com_apple_MobileAsset_MobileAccessoryUpdate_DurianFirmware/ae34f4b8aec8a4d4562227109be101728b7bef20.zip
python3 DurianFirmware_extract.py AssetData/DurianFirmware.acsw/DurianFirmwareMobileAsset.binThis will extract the following files, with ftab being the U1 firmware.
tag : blap offset : 0x9c size : 0x38340
tag : sftd offset : 0x383dc size : 0x1b400
tag : bldr offset : 0x537dc size : 0x5f9c
tag : basg offset : 0x59778 size : 0x47
tag : sdsg offset : 0x597c0 size : 0x48
tag : blsg offset : 0x59808 size : 0x47
tag : ftab offset : 0x59850 size : 0x924c5
Replace the sha384sum of rkos and dsp1 in the hook_durian_update_fud.js script
with the matching ones. For this, you also have to split the ftab using the external ftab_split.py script.
ftab_split.py ftab.bin
sha384sum rkos
1fcb05b377eb405eeffc5ad60efce6aeed3b83d834e0403bd88a142d84c6082ea6c649ebf14ae05b1a87d159e9dc167c rkos
sha384sum sbd1
928a226b85b52c75f07fb3cd89f1c38a783bb9834de647407b935a952359d36b243a58fa43a172d1e39c3d432d1a3030 sbd1Now we can use the TOCTOU to overwrite the firmware. Double-check which firmware is being used for the update, the folder might differ. The following is running on the iPhone:
iPhone:/private/var/MobileAsset/AssetsV2/com_apple_MobileAsset_MobileAccessoryUpdate_DurianFirmware/[your_version].asset/AssetData/DurianFirmware.acsw root#
while true; do cp /var/root/ftab_rose_airtag_old.bin ftab.bin; sleep 1; done
If you're not downgrading Rose and only the nRF parts, you might need to adapt overwrite_firmware.py. Otherwise, simply run:
python3 overwrite_firmware.pyNow, remove your AirTag from your account and pair it again. The update should start within 5 minutes.
If this wasn't the case, check your idevicesyslog. Possible reasons:
- Concurrent interaction with the AirTag that delayed the update process by 2h 30min. Just pair again.
- The current AirTag firmware version has a
deploymentLimit. Can probably fixed by overwriting thexmlfile in the same folder as the asset location on the iPhone.
The full list of L2CAP opcodes, since they might also be useful for reverse engineering and building clients independent of iOS. Note that Durian opcodes are for AirTags, and Hawkeye opcodes are likely for third-party Find My devices.
Durian opcode list:
[d] 0: Acknowledge
[d] 1: Rose Init
[d] 2: Rose Ready
[d] 3: Rose Start Ranging
[d] 4: Rose Ranging Complete
[d] 6: Rose Stop
[d] 7: Get Firmware Version
[d] 8: Stop Sound
[d] 10: Leashing
[d] 11: Set Max Connections
[d] 12: Get Multi Status
[d] 13: Set Obfuscated Identifier
[d] 14: Set Mutex
[d] 15: Set Near Owner Timeout
[d] 18: Get Firmware Version (Deprecated)
[d] 19: Unpair
[d] 21: Rose Set Paramaters
[d] 22: Rose Stop Ranging
[d] 24: Get User Stats
[d] 32: Abort FWDL
[d] 34: Rose Error
[d] 36: Rose P2P Timestamp
[d] 37: Rose Debug P2P Timestamp
[d] 38: Set Tag Type
[d] 39: Get Battery Status
[d] 40: Play Sound Sequence
[d] 42: Set Wild Mode Configuration
[d] 43: Roll Wild Key
[d] 45: Set Absolute Wild Mode Configuration
[d] 174: Fetch Current Key Index
[d] 175: Play Unauthorized Sound
[d] 177: Set Key Rotation Timeout
[d] 180: Dump Logs
[d] 181: Check Crashes
[d] 185: Induce Crash
[d] 195: Enable/Disable UT PlaySound Rate Limit
[d] 197: Set Central Reference Time
[d] 199: Set Accelerometeter Slope Mode Configuration
[d] 200: Set Accelerometer Orientation Mode Configuration
[d] 201: Get Accelerometer Slope Mode Configuration
[d] 202: Get Accelerometer Orientation Mode Configuration
[d] 203: Get Accelerometer Mode
[d] 209: Fetch ProductData AIS
[d] 210: Fetch ManufacturerName AIS
[d] 211: Fetch ModelName AIS
[d] 212: Fetch ModelColorCode AIS
[d] 213: Fetch AccessoryCategory AIS
[d] 214: Fetch AccessoryCapabilities AIS
[d] 215: Fetch FirmwareVersion AIS
[d] 216: Fetch FindMyVersion AIS
[d] 217: Fetch BatteryTyp AIS
[d] 218: Fetch BatteryLevel AIS
[d] 219: Send UARP message to accessory
[d] 220: Stop Unauthorized Sound
Hawkeye opcode list:
[h] 512: Sound Start
[h] 513: Sound Stop
[h] 514: Persistent Connection Status
[h] 515: Nearby Timeout
[h] 516: Unpair
[h] 517: Configure Separated State
[h] 518: Latch Separated Key
[h] 519: Set Max Connections
[h] 520: Set UTC
[h] 521: Get Multi Status
[h] 523: Command Response
[h] 524: Multi Status Response
[h] 525: Sound Complete
[h] 768: Non-Owner Sound Start
[h] 769: Non-Owner Sound Stop
[h] 770: Non-Owner Command Response
[h] 771: Non-Owner Sound Complete
[h] 1024: Get Current Primary Key
[h] 1025: Get iCloud Identifier
[h] 1026: Get Current Primary Key Response
[h] 1027: Get iCloud Identifier Response
[h] 1028: Get Serial Number
[h] 1029: Get Serial Number Response
[h] 1280: Key Rotation
[h] 1281: Retrieve Logs
[h] 1282: Log Response
[h] 1283: Debug Command Response
[h] 1284: Reset
[h] 1285: UT Motion Config