The iPhone Wiki - User contributions [en]

AFC

2014-04-06T02:42:05Z

Dirkg: /* AFC */

== AFC ==
AFC (Apple File Conduit) is a service that runs on every iPhone / iPod, which [[iTunes]] uses to exchange files with the device. It is jailed to the directory /private/var/mobile/Media, which is on the second (non-OS) partition. The AFC service is handled by /usr/libexec/afcd, and runs over the [[Normal Mode|usbmux protocol]].

== AFC2 ==
AFC2 is a an additional AFC service, configured to allow access to the whole filesystem. Installing it and patching the fstab file for full write access is considered a bare-bones [[jailbreak]]. The AFC2 service is added by editing the [[/System/Library/Lockdown/Services.plist]] file and adding a service that runs under root with access to the [[/|Root]] filesystem.

{{stub|software}}

User talk:Morpheus

2013-12-31T03:21:20Z

Dirkg:

mind explaining why you chopped out sections of information as "false"? so this doesn't blow up, i rewrote the entirety of that page because it didn't explain the process, and in-fact, i am rather regretting trying to base it off what you originally wrote as i didn't use jtool at all, i was using a hex editor and machoviewer. So instead of rewriting this as about specifically jtool, would you mind replacing the sections removed and labeled as "false" so people can future understand the RE process?
--[[User:Dirkg|Dirkg]] ([[User talk:Dirkg|talk]]) 03:21, 31 December 2013 (UTC)

User talk:Morpheus

2013-12-31T03:21:02Z

Dirkg: Created page with "mind explaining why you chopped out sections of information as "false"? so this doesn't blow up, i rewrote the entirety of that page because it didn't explain the process, and..."

User:Dirkg

2013-12-28T22:19:02Z

Dirkg:

Reverse engineer and system internals coder.

Contact:
* Twitter: @dirk_gently
* Email: me@samdmarshall.com

The iPhone Wiki:Community portal

2013-08-28T22:48:20Z

Dirkg: clarification on converting task

{{Talk Archive}}
{{see also|Unsolved problems}}
== iPhone-Elite ==
I think we should include all this old stuff before it gets lost: [http://code.google.com/p/iphone-elite/ code.google.com/p/iphone-elite/]. I mean the wiki articles there. Most infos should be already here, but I'm sure a lot of things are missing too.
--[[User:Http|http]] 15:02, 26 June 2012 (MDT)

== Boot-args cleanup ==
We need to clean up the boot-args pages. First the technical part: What I understand is that iBoot loads the kernel. And when loading it, it can pass some parameters to select certain behavior. So this only works with an iBoot or bootrom exploit. I understand that in earlier firmware versions there was simply an iBoot variable, but that doesn't exist or work anymore, now passing theses args requires a different or patched iBoot. There are various parameters in different kernel versions. The description for these arguments is scattered over various places:
*[[Kernel#Boot-Args]] A section with the latest boot arguments list. This should be a short introduction and having a link "main article".
*[[Boot-args (iBoot variable)]] separate page for boot arguments, but mainly for the iBoot variable that doesn't exist any longer
*[{{FULLURL:Boot arguments|redirect=no}} Boot arguments] (redirect)
*[[:Talk:Restore_Mode]] describing the iBoot variable problem
*Various pages referencing boot-args, like [[Research: Re-allowing unsigned ramdisks and boot-args with the 2.* iBoot]] (here we should have a link on the second title)
*My earlier comment [[:Talk:Kernel#boot-args]]
*This comment here.
So what do we want to do about this mess? I suggest to move the current [[Kernel]] content to the redirect page [[Boot arguments]] (or to another new page, maybe [[boot-args]]). The current content of [[Boot-args (iBoot variable)]] and all other content should get merged into there. Then change all references to this new page and on the [[Kernel]] page write just something short with "main article there". What do you think? --[[User:Http|http]] ([[User talk:Http|talk]]) 21:31, 13 February 2013 (UTC)
:I like [[Boot Arguments]]. --[[User:5urd|5urd]] ([[User talk:5urd|talk]]) 02:01, 14 February 2013 (UTC)
::One addition: Maybe we should use [[boot-args]] as the main page, because all links are written like that. --[[User:Http|http]] ([[User talk:Http|talk]]) 07:37, 14 February 2013 (UTC)

== The iPhone Wiki re-design ==
The design of the iPhone wiki is now quite old and I think it should be updated. I made a [http://oi42.tinypic.com/30ib9y8.jpg concept]. --[[User:Jaggions|Jaggions]] ([[User talk:Jaggions|talk]]) 10:30, 14 June 2013 (UTC)
:I disagree. If anything add an iPhone 5 to the logo but everything else is ok. --[[User:IAdam1n|iAdam1n]] ([[User talk:IAdam1n|talk]]) 11:05, 14 June 2013 (UTC)
:I wouldn't change the logo to an iPhone 5, especially with iOS 7 and a new iPhone (that will probably look the same as the 5, admittedly) around the corner. I contemplated updating the CSS for iOS 7's UI but decided not to because of the UI's supposed volatility (during the beta period) and I don't have a live version to toy around with. (I personally don't like its current state, but that's not a factor in why I'm not changing it yet.) --[[User:Dialexio|Dialexio]] ([[User talk:Dialexio|talk]]) 16:25, 14 June 2013 (UTC)
::Can we not do flat? --[[User:Haifisch|Haifisch]] ([[User talk:Haifisch|talk]]) 21:02, 14 June 2013 (UTC)
::This is what I was thinking. When iOS 7 finally comes out, we could change the CSS to look like that instead. --[[User:5urd|5urd]] ([[User talk:5urd|talk]]) 21:11, 14 June 2013 (UTC)
:::iOS 7 looks ugly. We do not want it like that. Maybe a bit more modern but nothing much. --[[User:IAdam1n|iAdam1n]] ([[User talk:IAdam1n|talk]]) 21:16, 14 June 2013 (UTC)
::::''You'' may not want it like that. That's your opinion. --[[User:5urd|5urd]] ([[User talk:5urd|talk]]) 01:55, 15 June 2013 (UTC)
:::::We could make a poll, and see if most users agree or disagree. --[[User:Jaggions|Jaggions]] ([[User talk:Jaggions|talk]]) 10:05, 15 June 2013 (UTC)
:The idea looks nice. But before we make any changes, let's wait until iOS7 comes out. And I'd prefer to just add another skin instead (if possible). I'm still using the classic MonoBook skin by the way. You shouldn't impose design changes to everyone. --[[User:Http|http]] ([[User talk:Http|talk]]) 14:38, 15 June 2013 (UTC)
::The problem with skins is that geohot needs to set them up... An idea I have is that we copy the Vector skin verbatim to a new skin (<code>iOS6</code>) and move the modifications (not general stuff) to [[Mediawiki:iOS6.css]]. Then we can do another verbatim copy to <code>iOS7</code> and modify [[Mediawiki:iOS7.css]]. We could then set the default skin to either <code>iOS6</code> or <code>iOS7</code> so you don't need to be logged in to see them like currently. Then if someone doesn't like them, like you, just change your settings to your preferred skin. The only way around needing geohot is if he opens up the credentials to FTP or whatever to someone. --[[User:5urd|5urd]] ([[User talk:5urd|talk]]) 21:17, 15 June 2013 (UTC)
:::I like [[User:5urd|5urd]]'s suggestion. --[[User:IAdam1n|iAdam1n]] ([[User talk:IAdam1n|talk]]) 22:29, 15 June 2013 (UTC)

== Dump page ==
I have been thinking, should we make [[Dump]] to list [[N88ap/Device Tree]] etc? We seem to have quite a few dumps but it seems silly not to have them all on one page. What do you all think? --[[User:IAdam1n|iAdam1n]] ([[User talk:IAdam1n|talk]]) 17:01, 3 July 2013 (UTC)

== Hacker page ==
I would like to be added to the list of hackers for my work with the Private Dev Team and the [[Chronic Dev Team]] in addition to my release of the Phoenix Semi-Untethered. --[[User:Ph0enix|Ph0enix]] ([[User talk:Ph0enix|talk]]) 18:36, 22 July 2013 (UTC)
:Did you find any exploits? --[[User:Haifisch|Haifisch]] ([[User talk:Haifisch|talk]]) 18:54, 22 July 2013 (UTC)
::No. [[User:phyrrus9|phyrrus9]], a team member found the vulnerability. I am the one who exploited it. --[[User:Ph0enix|Ph0enix]] ([[User talk:Ph0enix|talk]])
:::I can back up this "claim". I was a part of it. --[[User:5urd|5urd]] ([[User talk:5urd|talk]]) 20:52, 28 July 2013 (UTC)

== What beta number was 5A308? ==
I get the reasoning. Apple released one for enterprise use, then one for standard developer use. However, are we ''sure'' it was 2.0 beta 6? Why would Apple drop the suffix letter from the build on the ''same'' version? In addition, [[wikipedia:iOS SDK#iPhone OS 2.x: SDK|Wikipedia's "iOS SDK"]] reports that it was 2.0 beta ''7'' that received the two builds, ''not'' beta 6. Wrapping it all together:
5A292g - 2.0 beta 6
5A308 - 2.0 beta ? (Now in the 300s and suffix letter dropped)
5A331 - 2.0 beta 7
The Wikipedia article reports that 5A292g was released May 28. Ok, that's correct [[Firmware Keys#1.x.2F2.x|here]]. Wikipedia also reports that (the supposed two) beta 7 firmware was released June 9. Ok, the wiki is also correct for 5A331. However, we report that 5A308 was released on May 29. Now, either we are wrong, or Wikipedia is wrong. Either way, someone is wrong about the beta number ''and'' release date of 5A308. Anyone know of ''anything'' that can solve this? 
The [{{FULLURL:Firmware Keys|oldid=271}} very first version of "Firmware Keys"] already lists 5A308 as beta 6. In addition, the revision is dated July 27, so there is no timestamp to help solve this. --[[User:5urd|5urd]] ([[User talk:5urd|talk]]) 18:05, 17 August 2013 (UTC)
:I've tried [http://www.google.com/search?q=%22iPhone+OS%22+2+5A308 Google], and of the sites I've looked at, they report as 5A308 being "iPhone '''SDK''' beta 6", not "iPhone '''OS''' beta 6". Here are some excerpts from a [http://forums.macrumors.com/showpost.php?p=5519524&postcount=36 MacRumors thread] (emphasis mine):
I'm really confused about the 3G rumors relating to iPhone 2.0 '''Beta 6'''. ('''5A308''').
:Here is the title of one from [http://www.worldofapple.com/archives/2008/05/29/apple-releases-iphone-sdk-beta-6/ World of Apple] (dated May 29) (emphasis mine):
Apple Releases iPhone SDK '''Beta 6''', iPhone OS 2.0 '''Build 5A308'''
:This points in the direction of us being right, but can anyone help confirm this? --[[User:5urd|5urd]] ([[User talk:5urd|talk]]) 18:15, 17 August 2013 (UTC)

== Orphaned articles ==

This is an interesting search: [[Special:LonelyPages]] - "The following pages are not linked from or transcluded into other pages in The iPhone Wiki." I'm not sure where all of those articles should be linked, but figuring that out could be a useful project for somebody. [[User:Britta|Britta]] ([[User talk:Britta|talk]]) 05:57, 28 August 2013 (UTC)

==Key page idea==
I was wondering if it would be a good idea to make another category for key pages which do not have a complete key listing which has a bootrom exploit? That way, if people know how to get the keys, it would be easy to know which need to be added to. To me, the age does not matter as some people keep beta IPSW's stored no matter the age. Let me know what you all think. --[[User:IAdam1n|iAdam1n]] ([[User talk:IAdam1n|talk]]) 17:18, 28 August 2013 (UTC)

== Easy tasks for new editors ==
* Finish converting the remaining error codes listed here http://theiphonewiki.com/wiki/MobileDevice_Library#Known_Error_Codes into the proper mach_return_t codes they should be displayed as. (convert the negative number listed into hex, strip any leading "FF" so it should be in the format "0xe80000" followed by two numbers) --[[User:Dirkg|Dirkg]] ([[User talk:Dirkg|talk]]) 22:40, 28 August 2013 (UTC)

The iPhone Wiki:Community portal

2013-08-28T22:40:40Z

Dirkg: adding an "easy tasks" list for new editors

{{Talk Archive}}
{{see also|Unsolved problems}}
== iPhone-Elite ==
I think we should include all this old stuff before it gets lost: [http://code.google.com/p/iphone-elite/ code.google.com/p/iphone-elite/]. I mean the wiki articles there. Most infos should be already here, but I'm sure a lot of things are missing too.
--[[User:Http|http]] 15:02, 26 June 2012 (MDT)

== Boot-args cleanup ==
We need to clean up the boot-args pages. First the technical part: What I understand is that iBoot loads the kernel. And when loading it, it can pass some parameters to select certain behavior. So this only works with an iBoot or bootrom exploit. I understand that in earlier firmware versions there was simply an iBoot variable, but that doesn't exist or work anymore, now passing theses args requires a different or patched iBoot. There are various parameters in different kernel versions. The description for these arguments is scattered over various places:
*[[Kernel#Boot-Args]] A section with the latest boot arguments list. This should be a short introduction and having a link "main article".
*[[Boot-args (iBoot variable)]] separate page for boot arguments, but mainly for the iBoot variable that doesn't exist any longer
*[{{FULLURL:Boot arguments|redirect=no}} Boot arguments] (redirect)
*[[:Talk:Restore_Mode]] describing the iBoot variable problem
*Various pages referencing boot-args, like [[Research: Re-allowing unsigned ramdisks and boot-args with the 2.* iBoot]] (here we should have a link on the second title)
*My earlier comment [[:Talk:Kernel#boot-args]]
*This comment here.
So what do we want to do about this mess? I suggest to move the current [[Kernel]] content to the redirect page [[Boot arguments]] (or to another new page, maybe [[boot-args]]). The current content of [[Boot-args (iBoot variable)]] and all other content should get merged into there. Then change all references to this new page and on the [[Kernel]] page write just something short with "main article there". What do you think? --[[User:Http|http]] ([[User talk:Http|talk]]) 21:31, 13 February 2013 (UTC)
:I like [[Boot Arguments]]. --[[User:5urd|5urd]] ([[User talk:5urd|talk]]) 02:01, 14 February 2013 (UTC)
::One addition: Maybe we should use [[boot-args]] as the main page, because all links are written like that. --[[User:Http|http]] ([[User talk:Http|talk]]) 07:37, 14 February 2013 (UTC)

== The iPhone Wiki re-design ==
The design of the iPhone wiki is now quite old and I think it should be updated. I made a [http://oi42.tinypic.com/30ib9y8.jpg concept]. --[[User:Jaggions|Jaggions]] ([[User talk:Jaggions|talk]]) 10:30, 14 June 2013 (UTC)
:I disagree. If anything add an iPhone 5 to the logo but everything else is ok. --[[User:IAdam1n|iAdam1n]] ([[User talk:IAdam1n|talk]]) 11:05, 14 June 2013 (UTC)
:I wouldn't change the logo to an iPhone 5, especially with iOS 7 and a new iPhone (that will probably look the same as the 5, admittedly) around the corner. I contemplated updating the CSS for iOS 7's UI but decided not to because of the UI's supposed volatility (during the beta period) and I don't have a live version to toy around with. (I personally don't like its current state, but that's not a factor in why I'm not changing it yet.) --[[User:Dialexio|Dialexio]] ([[User talk:Dialexio|talk]]) 16:25, 14 June 2013 (UTC)
::Can we not do flat? --[[User:Haifisch|Haifisch]] ([[User talk:Haifisch|talk]]) 21:02, 14 June 2013 (UTC)
::This is what I was thinking. When iOS 7 finally comes out, we could change the CSS to look like that instead. --[[User:5urd|5urd]] ([[User talk:5urd|talk]]) 21:11, 14 June 2013 (UTC)
:::iOS 7 looks ugly. We do not want it like that. Maybe a bit more modern but nothing much. --[[User:IAdam1n|iAdam1n]] ([[User talk:IAdam1n|talk]]) 21:16, 14 June 2013 (UTC)
::::''You'' may not want it like that. That's your opinion. --[[User:5urd|5urd]] ([[User talk:5urd|talk]]) 01:55, 15 June 2013 (UTC)
:::::We could make a poll, and see if most users agree or disagree. --[[User:Jaggions|Jaggions]] ([[User talk:Jaggions|talk]]) 10:05, 15 June 2013 (UTC)
:The idea looks nice. But before we make any changes, let's wait until iOS7 comes out. And I'd prefer to just add another skin instead (if possible). I'm still using the classic MonoBook skin by the way. You shouldn't impose design changes to everyone. --[[User:Http|http]] ([[User talk:Http|talk]]) 14:38, 15 June 2013 (UTC)
::The problem with skins is that geohot needs to set them up... An idea I have is that we copy the Vector skin verbatim to a new skin (<code>iOS6</code>) and move the modifications (not general stuff) to [[Mediawiki:iOS6.css]]. Then we can do another verbatim copy to <code>iOS7</code> and modify [[Mediawiki:iOS7.css]]. We could then set the default skin to either <code>iOS6</code> or <code>iOS7</code> so you don't need to be logged in to see them like currently. Then if someone doesn't like them, like you, just change your settings to your preferred skin. The only way around needing geohot is if he opens up the credentials to FTP or whatever to someone. --[[User:5urd|5urd]] ([[User talk:5urd|talk]]) 21:17, 15 June 2013 (UTC)
:::I like [[User:5urd|5urd]]'s suggestion. --[[User:IAdam1n|iAdam1n]] ([[User talk:IAdam1n|talk]]) 22:29, 15 June 2013 (UTC)

== Dump page ==
I have been thinking, should we make [[Dump]] to list [[N88ap/Device Tree]] etc? We seem to have quite a few dumps but it seems silly not to have them all on one page. What do you all think? --[[User:IAdam1n|iAdam1n]] ([[User talk:IAdam1n|talk]]) 17:01, 3 July 2013 (UTC)

== Hacker page ==
I would like to be added to the list of hackers for my work with the Private Dev Team and the [[Chronic Dev Team]] in addition to my release of the Phoenix Semi-Untethered. --[[User:Ph0enix|Ph0enix]] ([[User talk:Ph0enix|talk]]) 18:36, 22 July 2013 (UTC)
:Did you find any exploits? --[[User:Haifisch|Haifisch]] ([[User talk:Haifisch|talk]]) 18:54, 22 July 2013 (UTC)
::No. [[User:phyrrus9|phyrrus9]], a team member found the vulnerability. I am the one who exploited it. --[[User:Ph0enix|Ph0enix]] ([[User talk:Ph0enix|talk]])
:::I can back up this "claim". I was a part of it. --[[User:5urd|5urd]] ([[User talk:5urd|talk]]) 20:52, 28 July 2013 (UTC)

== What beta number was 5A308? ==
I get the reasoning. Apple released one for enterprise use, then one for standard developer use. However, are we ''sure'' it was 2.0 beta 6? Why would Apple drop the suffix letter from the build on the ''same'' version? In addition, [[wikipedia:iOS SDK#iPhone OS 2.x: SDK|Wikipedia's "iOS SDK"]] reports that it was 2.0 beta ''7'' that received the two builds, ''not'' beta 6. Wrapping it all together:
5A292g - 2.0 beta 6
5A308 - 2.0 beta ? (Now in the 300s and suffix letter dropped)
5A331 - 2.0 beta 7
The Wikipedia article reports that 5A292g was released May 28. Ok, that's correct [[Firmware Keys#1.x.2F2.x|here]]. Wikipedia also reports that (the supposed two) beta 7 firmware was released June 9. Ok, the wiki is also correct for 5A331. However, we report that 5A308 was released on May 29. Now, either we are wrong, or Wikipedia is wrong. Either way, someone is wrong about the beta number ''and'' release date of 5A308. Anyone know of ''anything'' that can solve this? 
The [{{FULLURL:Firmware Keys|oldid=271}} very first version of "Firmware Keys"] already lists 5A308 as beta 6. In addition, the revision is dated July 27, so there is no timestamp to help solve this. --[[User:5urd|5urd]] ([[User talk:5urd|talk]]) 18:05, 17 August 2013 (UTC)
:I've tried [http://www.google.com/search?q=%22iPhone+OS%22+2+5A308 Google], and of the sites I've looked at, they report as 5A308 being "iPhone '''SDK''' beta 6", not "iPhone '''OS''' beta 6". Here are some excerpts from a [http://forums.macrumors.com/showpost.php?p=5519524&postcount=36 MacRumors thread] (emphasis mine):
I'm really confused about the 3G rumors relating to iPhone 2.0 '''Beta 6'''. ('''5A308''').
:Here is the title of one from [http://www.worldofapple.com/archives/2008/05/29/apple-releases-iphone-sdk-beta-6/ World of Apple] (dated May 29) (emphasis mine):
Apple Releases iPhone SDK '''Beta 6''', iPhone OS 2.0 '''Build 5A308'''
:This points in the direction of us being right, but can anyone help confirm this? --[[User:5urd|5urd]] ([[User talk:5urd|talk]]) 18:15, 17 August 2013 (UTC)

== Orphaned articles ==

This is an interesting search: [[Special:LonelyPages]] - "The following pages are not linked from or transcluded into other pages in The iPhone Wiki." I'm not sure where all of those articles should be linked, but figuring that out could be a useful project for somebody. [[User:Britta|Britta]] ([[User talk:Britta|talk]]) 05:57, 28 August 2013 (UTC)

==Key page idea==
I was wondering if it would be a good idea to make another category for key pages which do not have a complete key listing which has a bootrom exploit? That way, if people know how to get the keys, it would be easy to know which need to be added to. To me, the age does not matter as some people keep beta IPSW's stored no matter the age. Let me know what you all think. --[[User:IAdam1n|iAdam1n]] ([[User talk:IAdam1n|talk]]) 17:18, 28 August 2013 (UTC)

== Easy tasks for new editors ==
* Finish converting the remaining error codes listed here http://theiphonewiki.com/wiki/MobileDevice_Library#Known_Error_Codes into the proper mach_return_t codes they should be displayed as. --[[User:Dirkg|Dirkg]] ([[User talk:Dirkg|talk]]) 22:40, 28 August 2013 (UTC)

MobileDevice Library

2013-08-17T00:42:30Z

Dirkg: Removed old and incorrect information. (any missing info that would liked to be added back should be reviewed first)

{{float toc|right}}
MobileDevice Library is used by [[iTunes]] to transfer data between iPhone and computer over both USB and WiFi connections.

=== PC Windows: iTunesMobileDevice.dll ===
* Location: <code>C:\Program Files\Common Files\Apple\Mobile Device Support\iTunesMobileDevice.dll</code> (<code>Program Files (x86)</code> on 64-bit)
* Supporting CoreFoundation.dll (used for CFStringRef, CFPropertyListRef management) is located in the same dir (when using [[iTunes]] prior 9.0).
* For [[iTunes]] 9.0, the location of CoreFoundation.dll is stored in '''InstallDir''' registry value under '''HKLM\SOFTWARE\Apple Inc.\Apple Application Support''' registry key.

=== Mac OS X: MobileDevice.framework ===
* Location: /System/Library/PrivateFrameworks/MobileDevice.framework
* Export command: <code>nm /System/Library/PrivateFrameworks/MobileDevice.framework/Versions/A/MobileDevice</code>

=== Library Interfaces ===
* [http://www.libimobiledevice.org/ libimobiledevice] (provides the same functionality on GNU/Linux)
* [https://github.com/samdmarshall/SDMMobileDevice SDMMobileDevice] (a framework that can be used interchangeably with Apple's private framework MobileDevice.framework)
* [http://samdmarshall.com/media/MobileDevice.h MobileDevice.h] (old reverse engineered header for interfacing with MobileDevice library)

=== Private Functions ===

==== Obtaining address ====
In order to obtain the address of a usable private function in MobileDevice, you will have to be able to understand x86-64 assembly to reverse engineer it. These methods differ slightly based on platform due to how dynamically linked libraries handle position independent code.

=====Mac OS X (MobileDevice.framework)=====
A private function is not marked as exported in the mach-o symbol table. This means it cannot be called by simply linking against the library. To call unexported functions, the mach-o symbol table must be stepped through manually to find the offset of a particular function call. Calls can be verified by checking against the offset of the name inside the name table.

=====Windows (MobileDevice.dll)=====
Unlike OS X's dynamically linkable libraries, Windows dynamic libraries do not support position independent code in the same manner. A private function will not have its name in the exported symbol table, so in a debugger, like GDB, it will show up as part of another function. However, you will know that it is a separate function as a new stack frame is set up.

=== Known Error Codes ===
* kAMDSuccess = 0x0
* kAMDUndefinedError = 0xe8000001
* kAMDBadHeaderError = 0xe8000002
* kAMDNoResourcesError = 0xe8000003
* kAMDReadError = 0xe8000004
* kAMDWriteError = 0xe8000005
* kAMDUnknownPacketError = 0xe8000006
* kAMDInvalidArgumentError = 0xe8000007
* kAMDNotFoundError = 0xe8000008
* kAMDIsDirectoryError = 0xe8000009
* kAMDPermissionError = 0xe800000a
* kAMDNotConnectedError = 0xe800000b
* kAMDTimeOutError = 0xe800000c
* kAMDOverrunError = 0xe800000d
* kAMDEOFError = 0xe800000e
* kAMDUnsupportedError = 0xe800000f
* kAMDFileExistsError = 0xe8000010
* kAMDBusyError = 0xe8000011
* kAMDCryptoError = 0xe8000012
* kAMDInvalidResponseError = 0xe8000013
* kAMDMissingKeyError = 0xe8000014
* kAMDMissingValueError = 0xe8000015
* kAMDGetProhibitedError = 0xe8000016
* kAMDSetProhibitedError = 0xe8000017
* kAMDRemoveProhibitedError = 0xe8000018
* kAMDImmutableValueError = 0xe8000019
* kAMDPasswordProtectedError = 0xe800001a
* kAMDMissingHostIDError = 0xe800001b
* kAMDInvalidHostIDError = 0xe800001c
* kAMDSessionActiveError = 0xe800001d
* kAMDSessionInactiveError = 0xe800001e
* kAMDMissingSessionIDError = 0xe800001f
* kAMDInvalidSessionIDError = 0xe8000020
* kAMDMissingServiceError = 0xe8000021
* kAMDInvalidServiceError = 0xe8000022
* kAMDInvalidCheckinError = 0xe8000023
* kAMDCheckinTimeoutError = 0xe8000024
* kAMDMissingPairRecordError = 0xe8000025
* kAMDInvalidActivationRecordError = -402653146
* kAMDMissingActivationRecordError = -402653145
* kAMDWrongDroidError = -402653144
* kAMDSUVerificationError = -402653143
* kAMDSUPatchError = -402653142
* kAMDSUFirmwareError = -402653141
* kAMDProvisioningProfileNotValid = -402653140
* kAMDSendMessageError = -402653139
* kAMDReceiveMessageError = -402653138
* kAMDMissingOptionsError = -402653137
* kAMDMissingImageTypeError = -402653136
* kAMDDigestFailedError = -402653135
* kAMDStartServiceError = -402653134
* kAMDInvalidDiskImageError = -402653133
* kAMDMissingDigestError = -402653132
* kAMDMuxError = -402653131
* kAMDApplicationAlreadyInstalledError = -402653130
* kAMDApplicationMoveFailedError = -402653129
* kAMDApplicationSINFCaptureFailedError = -402653128
* kAMDApplicationSandboxFailedError = -402653127
* kAMDApplicationVerificationFailedError = -402653126
* kAMDArchiveDestructionFailedError = -402653125
* kAMDBundleVerificationFailedError = -402653124
* kAMDCarrierBundleCopyFailedError = -402653123
* kAMDCarrierBundleDirectoryCreationFailedError = -402653122
* kAMDCarrierBundleMissingSupportedSIMsError = -402653121
* kAMDCommCenterNotificationFailedError = -402653120
* kAMDContainerCreationFailedError = -402653119
* kAMDContainerP0wnFailedError = -402653118
* kAMDContainerRemovalFailedError = -402653117
* kAMDEmbeddedProfileInstallFailedError = -402653116
* kAMDErrorError = -402653115
* kAMDExecutableTwiddleFailedError = -402653114
* kAMDExistenceCheckFailedError = -402653113
* kAMDInstallMapUpdateFailedError = -402653112
* kAMDManifestCaptureFailedError = -402653111
* kAMDMapGenerationFailedError = -402653110
* kAMDMissingBundleExecutableError = -402653109
* kAMDMissingBundleIdentifierError = -402653108
* kAMDMissingBundlePathError = -402653107
* kAMDMissingContainerError = -402653106
* kAMDNotificationFailedError = -402653105
* kAMDPackageExtractionFailedError = -402653104
* kAMDPackageInspectionFailedError = -402653103
* kAMDPackageMoveFailedError = -402653102
* kAMDPathConversionFailedError = -402653101
* kAMDRestoreContainerFailedError = -402653100
* kAMDSeatbeltProfileRemovalFailedError = -402653099
* kAMDStageCreationFailedError = -402653098
* kAMDSymlinkFailedError = -402653097
* kAMDiTunesArtworkCaptureFailedError = -402653096
* kAMDiTunesMetadataCaptureFailedError = -402653095
* kAMDAlreadyArchivedError = -402653094
* kAMDProhibitedBySupervision = -402653053

User:Dirkg

2013-08-17T00:35:17Z

Dirkg:

Reverse engineer and system internals coder.

Contact:
* Twitter: @dirk_gently
* App.net: @sdm
* Email: me@samdmarshall.com
* GitHub: https://github.com/samdmarshall

User:Dirkg

2013-08-17T00:34:37Z

Dirkg: Created page with "Reverse engineer and system internals coder. Contact: Twitter: @dirk_gently App.net: @sdm Email: me@samdmarshall.com GitHub: https://github.com/samdmarshall"

Reverse engineer and system internals coder.

Contact:
Twitter: @dirk_gently
App.net: @sdm
Email: me@samdmarshall.com
GitHub: https://github.com/samdmarshall

MobileDevice Library

2013-08-17T00:26:16Z

Dirkg:

{{float toc|right}}
MobileDevice Library is used by [[iTunes]] to transfer data between iPhone and computer over both USB and WiFi connections.

=== PC Windows: iTunesMobileDevice.dll ===
* Location: <code>C:\Program Files\Common Files\Apple\Mobile Device Support\iTunesMobileDevice.dll</code> (<code>Program Files (x86)</code> on 64-bit)
* Supporting CoreFoundation.dll (used for CFStringRef, CFPropertyListRef management) is located in the same dir (when using [[iTunes]] prior 9.0).
* For [[iTunes]] 9.0, the location of CoreFoundation.dll is stored in '''InstallDir''' registry value under '''HKLM\SOFTWARE\Apple Inc.\Apple Application Support''' registry key.

=== Mac OS X: MobileDevice.framework ===
* Location: /System/Library/PrivateFrameworks/MobileDevice.framework
* Export command: <code>nm /System/Library/PrivateFrameworks/MobileDevice.framework/Versions/A/MobileDevice</code>

=== Library Interfaces ===
* [http://www.libimobiledevice.org/ libimobiledevice] (provides the same functionality on GNU/Linux)
* [https://github.com/samdmarshall/SDMMobileDevice SDMMobileDevice] (a framework that can be used interchangeably with Apple's private framework MobileDevice.framework)
* [http://samdmarshall.com/media/MobileDevice.h MobileDevice.h] (old reverse engineered header for interfacing with MobileDevice library)

=== Private Functions ===
==== Obtaining address ====
In order to obtain the address of a usable private function in MobileDevice, you will have to be able to understand x86-64 assembly to reverse engineer it. These methods differ slightly based on platform due to how dynamically linked libraries handle position independent code.
=====Mac OS X (MobileDevice.framework)=====
A private function is not marked as exported in the mach-o symbol table. This means it cannot be called by simply linking against the library. To call unexported functions, the mach-o symbol table must be stepped through manually to find the offset of a particular function call. Calls can be verified by checking against the offset of the name inside the name table.
=====Windows (MobileDevice.dll)=====
Unlike OS X's dynamically linkable libraries, Windows dynamic libraries do not support position independent code in the same manner. A private function will not have its name in the exported symbol table, so in a debugger, like GDB, it will show up as part of another function. However, you will know that it is a separate function as a new stack frame is set up.

=== Known Error Codes ===
* kAMDSuccess = 0x0
* kAMDUndefinedError = 0xe8000001
* kAMDBadHeaderError = 0xe8000002
* kAMDNoResourcesError = 0xe8000003
* kAMDReadError = 0xe8000004
* kAMDWriteError = 0xe8000005
* kAMDUnknownPacketError = 0xe8000006
* kAMDInvalidArgumentError = 0xe8000007
* kAMDNotFoundError = 0xe8000008
* kAMDIsDirectoryError = 0xe8000009
* kAMDPermissionError = 0xe800000a
* kAMDNotConnectedError = 0xe800000b
* kAMDTimeOutError = 0xe800000c
* kAMDOverrunError = 0xe800000d
* kAMDEOFError = 0xe800000e
* kAMDUnsupportedError = 0xe800000f
* kAMDFileExistsError = 0xe8000010
* kAMDBusyError = 0xe8000011
* kAMDCryptoError = 0xe8000012
* kAMDInvalidResponseError = 0xe8000013
* kAMDMissingKeyError = 0xe8000014
* kAMDMissingValueError = 0xe8000015
* kAMDGetProhibitedError = 0xe8000016
* kAMDSetProhibitedError = 0xe8000017
* kAMDRemoveProhibitedError = 0xe8000018
* kAMDImmutableValueError = 0xe8000019
* kAMDPasswordProtectedError = 0xe800001a
* kAMDMissingHostIDError = 0xe800001b
* kAMDInvalidHostIDError = 0xe800001c
* kAMDSessionActiveError = 0xe800001d
* kAMDSessionInactiveError = 0xe800001e
* kAMDMissingSessionIDError = 0xe800001f
* kAMDInvalidSessionIDError = 0xe8000020
* kAMDMissingServiceError = 0xe8000021
* kAMDInvalidServiceError = 0xe8000022
* kAMDInvalidCheckinError = 0xe8000023
* kAMDCheckinTimeoutError = 0xe8000024
* kAMDMissingPairRecordError = 0xe8000025
* kAMDInvalidActivationRecordError = -402653146
* kAMDMissingActivationRecordError = -402653145
* kAMDWrongDroidError = -402653144
* kAMDSUVerificationError = -402653143
* kAMDSUPatchError = -402653142
* kAMDSUFirmwareError = -402653141
* kAMDProvisioningProfileNotValid = -402653140
* kAMDSendMessageError = -402653139
* kAMDReceiveMessageError = -402653138
* kAMDMissingOptionsError = -402653137
* kAMDMissingImageTypeError = -402653136
* kAMDDigestFailedError = -402653135
* kAMDStartServiceError = -402653134
* kAMDInvalidDiskImageError = -402653133
* kAMDMissingDigestError = -402653132
* kAMDMuxError = -402653131
* kAMDApplicationAlreadyInstalledError = -402653130
* kAMDApplicationMoveFailedError = -402653129
* kAMDApplicationSINFCaptureFailedError = -402653128
* kAMDApplicationSandboxFailedError = -402653127
* kAMDApplicationVerificationFailedError = -402653126
* kAMDArchiveDestructionFailedError = -402653125
* kAMDBundleVerificationFailedError = -402653124
* kAMDCarrierBundleCopyFailedError = -402653123
* kAMDCarrierBundleDirectoryCreationFailedError = -402653122
* kAMDCarrierBundleMissingSupportedSIMsError = -402653121
* kAMDCommCenterNotificationFailedError = -402653120
* kAMDContainerCreationFailedError = -402653119
* kAMDContainerP0wnFailedError = -402653118
* kAMDContainerRemovalFailedError = -402653117
* kAMDEmbeddedProfileInstallFailedError = -402653116
* kAMDErrorError = -402653115
* kAMDExecutableTwiddleFailedError = -402653114
* kAMDExistenceCheckFailedError = -402653113
* kAMDInstallMapUpdateFailedError = -402653112
* kAMDManifestCaptureFailedError = -402653111
* kAMDMapGenerationFailedError = -402653110
* kAMDMissingBundleExecutableError = -402653109
* kAMDMissingBundleIdentifierError = -402653108
* kAMDMissingBundlePathError = -402653107
* kAMDMissingContainerError = -402653106
* kAMDNotificationFailedError = -402653105
* kAMDPackageExtractionFailedError = -402653104
* kAMDPackageInspectionFailedError = -402653103
* kAMDPackageMoveFailedError = -402653102
* kAMDPathConversionFailedError = -402653101
* kAMDRestoreContainerFailedError = -402653100
* kAMDSeatbeltProfileRemovalFailedError = -402653099
* kAMDStageCreationFailedError = -402653098
* kAMDSymlinkFailedError = -402653097
* kAMDiTunesArtworkCaptureFailedError = -402653096
* kAMDiTunesMetadataCaptureFailedError = -402653095
* kAMDAlreadyArchivedError = -402653094
* kAMDProhibitedBySupervision = -402653053

MobileDevice Library

2013-08-17T00:25:08Z

Dirkg:

{{float toc|right}}
MobileDevice Library is used by [[iTunes]] to transfer data between iPhone and computer over both USB and WiFi connections.

=== PC Windows: iTunesMobileDevice.dll ===
* Location: <code>C:\Program Files\Common Files\Apple\Mobile Device Support\iTunesMobileDevice.dll</code> (<code>Program Files (x86)</code> on 64-bit)
* Supporting CoreFoundation.dll (used for CFStringRef, CFPropertyListRef management) is located in the same dir (when using [[iTunes]] prior 9.0).
* For [[iTunes]] 9.0, the location of CoreFoundation.dll is stored in '''InstallDir''' registry value under '''HKLM\SOFTWARE\Apple Inc.\Apple Application Support''' registry key.

=== Mac OS X: MobileDevice.framework ===
* Location: /System/Library/PrivateFrameworks/MobileDevice.framework
* Export command: <code>nm /System/Library/PrivateFrameworks/MobileDevice.framework/Versions/A/MobileDevice</code>

=== Libraries Implementations ===
* [http://www.libimobiledevice.org/ libimobiledevice] (provides the same functionality on GNU/Linux)
* [https://github.com/samdmarshall/SDMMobileDevice SDMMobileDevice] (a framework that can be used interchangeably with Apple's private framework MobileDevice.framework)
* [http://samdmarshall.com/media/MobileDevice.h MobileDevice.h] (old reverse engineered header for interfacing with MobileDevice library)

=== Private Functions ===
==== Obtaining address ====
In order to obtain the address of a usable private function in MobileDevice, you will have to be able to understand x86-64 assembly to reverse engineer it. These methods differ slightly based on platform due to how dynamically linked libraries handle position independent code.
=====Mac OS X (MobileDevice.framework)=====
A private function is not marked as exported in the mach-o symbol table. This means it cannot be called by simply linking against the library. To call unexported functions, the mach-o symbol table must be stepped through manually to find the offset of a particular function call. Calls can be verified by checking against the offset of the name inside the name table.
=====Windows (MobileDevice.dll)=====
Unlike OS X's dynamically linkable libraries, Windows dynamic libraries do not support position independent code in the same manner. A private function will not have its name in the exported symbol table, so in a debugger, like GDB, it will show up as part of another function. However, you will know that it is a separate function as a new stack frame is set up.

=== Known Error Codes ===
* kAMDSuccess = 0x0
* kAMDUndefinedError = 0xe8000001
* kAMDBadHeaderError = 0xe8000002
* kAMDNoResourcesError = 0xe8000003
* kAMDReadError = 0xe8000004
* kAMDWriteError = 0xe8000005
* kAMDUnknownPacketError = 0xe8000006
* kAMDInvalidArgumentError = 0xe8000007
* kAMDNotFoundError = 0xe8000008
* kAMDIsDirectoryError = 0xe8000009
* kAMDPermissionError = 0xe800000a
* kAMDNotConnectedError = 0xe800000b
* kAMDTimeOutError = 0xe800000c
* kAMDOverrunError = 0xe800000d
* kAMDEOFError = 0xe800000e
* kAMDUnsupportedError = 0xe800000f
* kAMDFileExistsError = 0xe8000010
* kAMDBusyError = 0xe8000011
* kAMDCryptoError = 0xe8000012
* kAMDInvalidResponseError = 0xe8000013
* kAMDMissingKeyError = 0xe8000014
* kAMDMissingValueError = 0xe8000015
* kAMDGetProhibitedError = 0xe8000016
* kAMDSetProhibitedError = 0xe8000017
* kAMDRemoveProhibitedError = 0xe8000018
* kAMDImmutableValueError = 0xe8000019
* kAMDPasswordProtectedError = 0xe800001a
* kAMDMissingHostIDError = 0xe800001b
* kAMDInvalidHostIDError = 0xe800001c
* kAMDSessionActiveError = 0xe800001d
* kAMDSessionInactiveError = 0xe800001e
* kAMDMissingSessionIDError = 0xe800001f
* kAMDInvalidSessionIDError = 0xe8000020
* kAMDMissingServiceError = 0xe8000021
* kAMDInvalidServiceError = 0xe8000022
* kAMDInvalidCheckinError = 0xe8000023
* kAMDCheckinTimeoutError = 0xe8000024
* kAMDMissingPairRecordError = 0xe8000025
* kAMDInvalidActivationRecordError = -402653146
* kAMDMissingActivationRecordError = -402653145
* kAMDWrongDroidError = -402653144
* kAMDSUVerificationError = -402653143
* kAMDSUPatchError = -402653142
* kAMDSUFirmwareError = -402653141
* kAMDProvisioningProfileNotValid = -402653140
* kAMDSendMessageError = -402653139
* kAMDReceiveMessageError = -402653138
* kAMDMissingOptionsError = -402653137
* kAMDMissingImageTypeError = -402653136
* kAMDDigestFailedError = -402653135
* kAMDStartServiceError = -402653134
* kAMDInvalidDiskImageError = -402653133
* kAMDMissingDigestError = -402653132
* kAMDMuxError = -402653131
* kAMDApplicationAlreadyInstalledError = -402653130
* kAMDApplicationMoveFailedError = -402653129
* kAMDApplicationSINFCaptureFailedError = -402653128
* kAMDApplicationSandboxFailedError = -402653127
* kAMDApplicationVerificationFailedError = -402653126
* kAMDArchiveDestructionFailedError = -402653125
* kAMDBundleVerificationFailedError = -402653124
* kAMDCarrierBundleCopyFailedError = -402653123
* kAMDCarrierBundleDirectoryCreationFailedError = -402653122
* kAMDCarrierBundleMissingSupportedSIMsError = -402653121
* kAMDCommCenterNotificationFailedError = -402653120
* kAMDContainerCreationFailedError = -402653119
* kAMDContainerP0wnFailedError = -402653118
* kAMDContainerRemovalFailedError = -402653117
* kAMDEmbeddedProfileInstallFailedError = -402653116
* kAMDErrorError = -402653115
* kAMDExecutableTwiddleFailedError = -402653114
* kAMDExistenceCheckFailedError = -402653113
* kAMDInstallMapUpdateFailedError = -402653112
* kAMDManifestCaptureFailedError = -402653111
* kAMDMapGenerationFailedError = -402653110
* kAMDMissingBundleExecutableError = -402653109
* kAMDMissingBundleIdentifierError = -402653108
* kAMDMissingBundlePathError = -402653107
* kAMDMissingContainerError = -402653106
* kAMDNotificationFailedError = -402653105
* kAMDPackageExtractionFailedError = -402653104
* kAMDPackageInspectionFailedError = -402653103
* kAMDPackageMoveFailedError = -402653102
* kAMDPathConversionFailedError = -402653101
* kAMDRestoreContainerFailedError = -402653100
* kAMDSeatbeltProfileRemovalFailedError = -402653099
* kAMDStageCreationFailedError = -402653098
* kAMDSymlinkFailedError = -402653097
* kAMDiTunesArtworkCaptureFailedError = -402653096
* kAMDiTunesMetadataCaptureFailedError = -402653095
* kAMDAlreadyArchivedError = -402653094
* kAMDProhibitedBySupervision = -402653053