Talk:SHSH Protocol

2011-06-08T16:42:37Z

Miketress:

== Naming ==
Or should I better have named this '''TSS Protocol''' instead? -- [[User:Http|http]] 21:23, 15 August 2010 (UTC)

I think the current title is easier to tell it relates to shsh. I can't recall what tss stands for, and I think it would also be easier to find. [[User:Iemit737|Iemit737]] 21:36, 15 August 2010 (UTC)

== Implementation ==

How can I implement this on a Linux-based system? I have the request, but the 'telnet' and 'POST' commands don't work. --[[User:Dra1nerdrake|dra1nerdrake]] 22:40, 15 August 2010 (UTC)

Telnet should work. Just enter
telnet gs.apple.com 80
Then you get a HTTP connection. Then send the request and terminate with two CR/LF and you get the response. You can try with any other web page first, that should work the same way:
telnet www.google.com 80
Then:
GET / HTTP/1.0

And didn't [[User:Semaphore|semaphore]] release a unix version with some source code of [[TinyUmbrella]]? -- [[User:Http|http]] 23:49, 15 August 2010 (UTC)

Great, thanks, forgot the port number. He released unix TinyUmbrella, but it segfaults and I can't code in Java. --[[User:Dra1nerdrake|dra1nerdrake]] 04:18, 16 August 2010 (UTC)

EDIT: I can't seem to get it to work. I do:
telnet cydia.saurik.com 80
Then I do
POST /TSS/controller?action=2 HTTP/1.1
Accept: */*
Cache-Control: no-cache
Content-type: text/xml; charset="utf-8"
User-Agent: InetURL/1.0
Content-Length: 411
Host: gs.apple.com

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>@HostIpAddress</key>
<string>192.168.0.1</string>
<key>@HostPlatformInfo</key>
<string>darwin</string>
<key>@VersionInfo</key>
<string>3.8</string>
<key>@Locality</key>
<string>en_US</string>
<key>ApProductionMode</key>
<true/>
<key>ApECID</key>
<string>1430661561679</string>
<key>ApChipID</key>
<integer>35106</integer>
<key>ApBoardID</key>
<integer>2</integer>
<key>ApSecurityDomain</key>
<integer>1</integer>
<key>UniqueBuildID</key>
<data>
uvWKIop3L16LfQymS8IyiDZXXw0=
</data>
<key>AppleLogo</key>
<dict>
<key>Digest</key>
<data>
kK7SLPJWvaq+GAn9Dm/sG6aJjXg=
</data>
<key>Info</key>
<dict>
<key>IsFirmwarePayload</key>
<true/>
<key>Path</key>
<string>Firmware/all_flash/all_flash.n18ap.production/applelogo.s5l8922x.img3</string>
</dict>
<key>PartialDigest</key>
<data>
QAAAAHgdAADDPQY07wMJ1z2qVSjKuM4iqjhFKw==
</data>
<key>Trusted</key>
<true/>
</dict>
<key>BatteryCharging</key>
<dict>
<key>Digest</key>
<data>
lvxtYniO/PKy46ZZV0YIe9ZeNt0=
</data>
<key>Info</key>
<dict>
<key>IsFirmwarePayload</key>
<true/>
<key>Path</key>
<string>Firmware/all_flash/all_flash.n18ap.production/glyphcharging.s5l8922x.img3</string>
</dict>
<key>PartialDigest</key>
<data>
QAAAAHhHAADPFoOCbp1jZBqTtFlCT3XE/qYkKw==
</data>
<key>Trusted</key>
<true/>
</dict>
<key>BatteryCharging0</key>
<dict>
<key>Digest</key>
<data>
+o+lH7zqvh90+/cRCjNeSmTsNvU=
</data>
<key>Info</key>
<dict>
<key>IsFirmwarePayload</key>
<true/>
<key>Path</key>
<string>Firmware/all_flash/all_flash.n18ap.production/batterycharging0.s5l8922x.img3</string>
</dict>
<key>PartialDigest</key>
<data>
QAAAAPhEAADGKdYO2peJTZrXjeitEdUEMiC8hw==
</data>
<key>Trusted</key>
<true/>
</dict>
<key>BatteryCharging1</key>
<dict>
<key>Digest</key>
<data>
u7NDP6MdWuEGT5Q4Qsm/OrsGTuE=
</data>
<key>Info</key>
<dict>
<key>IsFirmwarePayload</key>
<true/>
<key>Path</key>
<string>Firmware/all_flash/all_flash.n18ap.production/batterycharging1.s5l8922x.img3</string>
</dict>
<key>PartialDigest</key>
<data>
QAAAADhZAAAWwQq0Y75xTjOyQ9gxMVNrczF01g==
</data>
<key>Trusted</key>
<true/>
</dict>
<key>BatteryFull</key>
<dict>
<key>Digest</key>
<data>
fTK7DLd3XJTHX9ywLJy97+VeUN0=
</data>
<key>Info</key>
<dict>
<key>IsFirmwarePayload</key>
<true/>
<key>Path</key>
<string>Firmware/all_flash/all_flash.n18ap.production/batteryfull.s5l8922x.img3</string>
</dict>
<key>PartialDigest</key>
<data>
QAAAADghAQDNQ9aqlsb/szaE/5Xh9OJF1WIhxw==
</data>
<key>Trusted</key>
<true/>
</dict>
<key>BatteryLow0</key>
<dict>
<key>Digest</key>
<data>
rdMyyO2tICLCLzvxY05lirfWrzQ=
</data>
<key>Info</key>
<dict>
<key>IsFirmwarePayload</key>
<true/>
<key>Path</key>
<string>Firmware/all_flash/all_flash.n18ap.production/batterylow0.s5l8922x.img3</string>
</dict>
<key>PartialDigest</key>
<data>
QAAAALjVAAB7wuaDZva7tC1CGWUl4ATOZ7aUbA==
</data>
<key>Trusted</key>
<true/>
</dict>
<key>BatteryLow1</key>
<dict>
<key>Digest</key>
<data>
ecfArQo2Cxly0h6D7iYT9TLKSSE=
</data>
<key>Info</key>
<dict>
<key>IsFirmwarePayload</key>
<true/>
<key>Path</key>
<string>Firmware/all_flash/all_flash.n18ap.production/batterylow1.s5l8922x.img3</string>
</dict>
<key>PartialDigest</key>
<data>
QAAAAPj2AAABqpmcEB9sOeTSulytXfC8KWZU9g==
</data>
<key>Trusted</key>
<true/>
</dict>
<key>BatteryPlugin</key>
<dict>
<key>Digest</key>
<data>
MtXc08RsYs+6BMhD4kY0quNr/AU=
</data>
<key>Info</key>
<dict>
<key>IsFirmwarePayload</key>
<true/>
<key>Path</key>
<string>Firmware/all_flash/all_flash.n18ap.production/glyphplugin.s5l8922x.img3</string>
</dict>
<key>PartialDigest</key>
<data>
QAAAAHhDAABQJN3XJEBkNhnJqv6Ra2zBYJeuoQ==
</data>
<key>Trusted</key>
<true/>
</dict>
<key>DeviceTree</key>
<dict>
<key>Digest</key>
<data>
ngiLrFM16Bg/BkPkmqf59h3H90c=
</data>
<key>Info</key>
<dict>
<key>IsFirmwarePayload</key>
<true/>
<key>Path</key>
<string>Firmware/all_flash/all_flash.n18ap.production/DeviceTree.n18ap.img3</string>
</dict>
<key>PartialDigest</key>
<data>
QAAAALiDAABl290rfckYS+L3TjGRA7j8avdgDg==
</data>
<key>Trusted</key>
<true/>
</dict>
<key>KernelCache</key>
<dict>
<key>Digest</key>
<data>
F978uz3zV6USmE34FMmm6xeQDwU=
</data>
<key>Info</key>
<dict>
<key>Path</key>
<string>kernelcache.release.s5l8922x</string>
</dict>
<key>PartialDigest</key>
<data>
QAAAALhxPQDOpPhRPAe/mVP5J89iIhtaQEmJgg==
</data>
<key>Trusted</key>
<true/>
</dict>
<key>LLB</key>
<dict>
<key>BuildString</key>
<string>iBoot-636.66~5</string>
<key>Info</key>
<dict>
<key>IsFirmwarePayload</key>
<true/>
<key>Path</key>
<string>Firmware/all_flash/all_flash.n18ap.production/LLB.n18ap.RELEASE.img3</string>
</dict>
<key>PartialDigest</key>
<data>
QAAAADgxAQDkevEFsIGKqarjmv9T7avG8oGXhg==
</data>
</dict>
<key>NeedService</key>
<dict>
<key>Digest</key>
<data>
klkKn9XNikUb9bdtVU7b2yv9OYc=
</data>
<key>Info</key>
<dict>
<key>IsFirmwarePayload</key>
<true/>
<key>Path</key>
<string>Firmware/all_flash/all_flash.n18ap.production/needservice.s5l8922x.img3</string>
</dict>
<key>PartialDigest</key>
<data>
QAAAALhHAACO1eYCz8W9YsCQ5OT1T0CFHk+aHQ==
</data>
<key>Trusted</key>
<true/>
</dict>
<key>OS</key>
<dict>
<key>Info</key>
<dict>
<key>Path</key>
<string>018-6152-014.dmg</string>
</dict>
</dict>
<key>RecoveryMode</key>
<dict>
<key>Digest</key>
<data>
DjD6JMIq4Qnnsay14L3jL+AdxPs=
</data>
<key>Info</key>
<dict>
<key>IsFirmwarePayload</key>
<true/>
<key>Path</key>
<string>Firmware/all_flash/all_flash.n18ap.production/recoverymode.s5l8922x.img3</string>
</dict>
<key>PartialDigest</key>
<data>
QAAAAPiyAABju7ZnxiRutww2vcmjIIlXG4KSAA==
</data>
<key>Trusted</key>
<true/>
</dict>
<key>RestoreDeviceTree</key>
<dict>
<key>Digest</key>
<data>
ngiLrFM16Bg/BkPkmqf59h3H90c=
</data>
<key>Info</key>
<dict>
<key>Path</key>
<string>Firmware/all_flash/all_flash.n18ap.production/DeviceTree.n18ap.img3</string>
</dict>
<key>PartialDigest</key>
<data>
QAAAALiDAABl290rfckYS+L3TjGRA7j8avdgDg==
</data>
<key>Trusted</key>
<true/>
</dict>
<key>RestoreKernelCache</key>
<dict>
<key>Digest</key>
<data>
F978uz3zV6USmE34FMmm6xeQDwU=
</data>
<key>Info</key>
<dict>
<key>Path</key>
<string>kernelcache.release.s5l8922x</string>
</dict>
<key>PartialDigest</key>
<data>
QAAAALhxPQDOpPhRPAe/mVP5J89iIhtaQEmJgg==
</data>
<key>Trusted</key>
<true/>
</dict>
<key>RestoreLogo</key>
<dict>
<key>Digest</key>
<data>
kK7SLPJWvaq+GAn9Dm/sG6aJjXg=
</data>
<key>Info</key>
<dict>
<key>Path</key>
<string>Firmware/all_flash/all_flash.n18ap.production/applelogo.s5l8922x.img3</string>
</dict>
<key>PartialDigest</key>
<data>
QAAAAHgdAADDPQY07wMJ1z2qVSjKuM4iqjhFKw==
</data>
<key>Trusted</key>
<true/>
</dict>
<key>RestoreRamDisk</key>
<dict>
<key>Digest</key>
<data>
20tqZkEp1wApx1tz+ZCP38axvHE=
</data>
<key>Info</key>
<dict>
<key>Path</key>
<string>018-6145-014.dmg</string>
</dict>
<key>PartialDigest</key>
<data>
QAAAAPjQuwAyMjwJWKpL0b8bUzYKajbbPEVuPA==
</data>
<key>Trusted</key>
<true/>
</dict>
<key>iBEC</key>
<dict>
<key>BuildString</key>
<string>iBoot-636.66~5</string>
<key>Info</key>
<dict>
<key>Path</key>
<string>Firmware/dfu/iBEC.n18ap.RELEASE.dfu</string>
</dict>
<key>PartialDigest</key>
<data>
QAAAADjRAQDQA4xYDDo21pS9j57YWeGp6l/TvA==
</data>
</dict>
<key>iBSS</key>
<dict>
<key>BuildString</key>
<string>iBoot-636.66~5</string>
<key>Info</key>
<dict>
<key>Path</key>
<string>Firmware/dfu/iBSS.n18ap.RELEASE.dfu</string>
</dict>
<key>PartialDigest</key>
<data>
QAAAADjRAQA2J3DDdRv+TmjaGodpeT634g/Haw==
</data>
</dict>
<key>iBoot</key>
<dict>
<key>Digest</key>
<data>
soCT6YL1cig/OKRvbam3igRcvaQ=
</data>
<key>Info</key>
<dict>
<key>IsFirmwarePayload</key>
<true/>
<key>Path</key>
<string>Firmware/all_flash/all_flash.n18ap.production/iBoot.n18ap.RELEASE.img3</string>
</dict>
<key>PartialDigest</key>
<data>
QAAAADihAgB46rf/axQHtuftGLR8SDpdOuOywA==
</data>
<key>Trusted</key>
<true/>
</dict>
</dict>
</plist>
<CR><LF>
<CR><LF>
But no dice. --[[User:Dra1nerdrake|dra1nerdrake]] 18:33, 16 August 2010 (UTC)
----
*I think your main problem is that your content is more than the 411 bytes that you specified.
*Where do you have the digest etc. values from?
*In my article I didn't write about the Info key you added. What is that?
-- [[User:Http|http]] 20:45, 16 August 2010 (UTC)

I copied the entire plist from a plist generated by [[idevicerestore]]. Digest values are from the buildmanifest.plist, at the root directory of the firmware. I ran it in debug mode (-d). What should I put in place of 411? --[[User:Dra1nerdrake|dra1nerdrake]] 02:12, 17 August 2010 (UTC)

It should be the size of the data you transfer. The data seems to be much longer than 411 bytes, I didn't count though. See section 14.13 [http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html here (RFC2616)]. --[[User:Http|http]] 03:56, 17 August 2010 (UTC)

Did it finally work for you? Also: Do you know how [[idevicerestore]] creates these Digest values? If you find that out, maybe you can update the article. -- [[User:Http|http]] 22:42, 24 August 2010 (UTC)

Curl is more suitable for LL HTTP, try something like:
<pre>
$ curl -v "http://cydia.saurik.com/TSS/controller?action=2" -X POST -d @1.plist -H "Host: gs.apple.com" -H "Content-type: text/xml; charset=utf8"
* About to connect() to cydia.saurik.com port 80 (#0)
* Trying 74.208.10.249... connected
* Connected to cydia.saurik.com (74.208.10.249) port 80 (#0)
> POST /TSS/controller?action=2 HTTP/1.1
> User-Agent: curl/7.19.7 (universal-apple-darwin10.0) libcurl/7.19.7 OpenSSL/0.9.8l zlib/1.2.3
> Accept: */*
> Host: gs.apple.com
> Content-type: text/xml; charset=utf8
> Content-Length: 8222
> Expect: 100-continue
>
< HTTP/1.1 100 Continue
< HTTP/1.1 200 OK
< Server: nginx/0.7.64
< Date: Thu, 26 Aug 2010 09:27:56 GMT
< Content-Type: text/plain
< Transfer-Encoding: chunked
< Connection: keep-alive
< Cache-Control: private, proxy-revalidate
<
STATUS=94&MESSAGE=This device isn't eligible for the requested build.
* Connection #0 to host cydia.saurik.com left intact
* Closing connection #0
</pre>
where 1.plist is a file with your plist
--[[User:Vasfed|Vasfed]] 09:41, 26 August 2010 (UTC)

curl needs an extra header with a blank Expect to get past the "Done waiting for 100-continue" error. Add -H "Expect:" to the command above.

--[[User:Miketress|Miketress]] 18:43, 8 June 2011 (GMT+1)

== Request? ==
I'm still not understanding the telnet part of this. I can connect fine, but what exactly is the request that I have to send in order to get back a plist file with the SHSH blobs? --[[User:Cool name|Cool name]] 04:08, 16 August 2010 (UTC)
== Rewrite ==
Somebody should rewrite this article as it is partially wrong and the iPhone 4 needs more values but i cant seem to figure out all of them.--[[User:sn0wra1n|sn0wra1n]]
: it is not that different [http://pastebin.com/r8XNaVFY iphone 4 build manifest] and [http://pastebin.com/f2wv9y2m iphone 3gs build manifest] the only difference is

<key>BbChipID</key>
<string>0x50</string>
<key>BbSkeyId</key>
<data>
l6s0rAaT9bA7+3JtTiwlTxTicKE=
</data>
<key>EBL-Digest</key>
<data>B/rJD65edrIfdautbDNZaJuUfOU=</data>
<key>FlashPSI-PartialDigest</key>
<data>QAQAAMB6AACo7NXgZ2muHRNmX3gIXFDTaxOfUA==</data>
<key>FlashPSI-SecPackDigest</key>
<data>aV7n5VUpvSbMWA4ImMj4R0vfpmk=</data>
<key>FlashPSI-Version</key>
<string>0x00020008</string>
<key>Info</key>
<dict>
<key>Path</key>
<string>Firmware/ICE3_03.10.01_BOOT_02.08.Release.bbfw</string>
</dict>
<key>ModemStack-Digest</key>
<data>Bf9WSgSASGLSpQqRYdAFIt6Nce8=</data>
<key>ModemStack-Length</key>
<string>0x006f0934</string>
<key>ModemStack-SecPackDigest</key>
<data>sjmc0PFoajjg5fJLcLztnN27YVM=</data>
<key>RamPSI-PartialDigest</key>
<data>QAQAAMD5AACPnk/ZFyWqznQdTlQX95aC8NXjqQ==</data>
<key>RamPSI-Version</key>
<string>0x00020008</string>
</dict>
</plist>
--[[User:Liamchat|liamchat]] 13:12, 19 December 2010 (UTC)
:So if i want to create a SHSH request, i just copy the BuildManifest.plist and add the ECID value only? If no, is there any sample SHSH Request plist with the entire thing? --[[User:sn0wra1n|sn0wra1n]]
::yes but the baseband will also give its nonce key ( witch is required to validate the shsh of the baseband ) so you could cash the baseband shsh's but the nonce is what makes them work --[[User:Liamchat|liamchat]] 14:59, 19 December 2010 (UTC)

I decided to use my iPod Touch 4 then my iPhone 4 so this is what I got [http://pastie.org/private/7xcigxahj9sdfjeoa5f0w SHSH Request Plist] but the problem is I dont receive anything after submitting. How long should I wait to receive it?
*How do i calculate my content-length (with or without the headers size?)
*Must the plist be spaced/formatted correctly?
--[[User:Sn0wra1n|Sn0wra1n]] 01:59, 21 December 2010 (UTC)
:*Content-Length: This is the standard http protocol. See [http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.13 RFC2616] chapters 14.13 and 4.4. In short: only the message body, not the header.
:*spacing/formatting: shouldn't matter; it's XML
:*time: answer should come immediately. If you get no reply, try to get the Google start page this way first - there you don't need a message body. Also you can start with HTTP/1.0, there you don't need ''any'' header rows (except the GET statement of course):
GET / HTTP/1.0

:--[[User:Http|http]] 07:41, 21 December 2010 (UTC)

Actually im not sure about calculating the Content-Length.Is it just the xml files words including spaces or not including spaces? --[[User:Sn0wra1n|Sn0wra1n]] 10:07, 21 December 2010 (UTC)
:It includes every byte you send: spaces, carriage-return, linefeed, etc. --[[User:Http|http]] 16:28, 21 December 2010 (UTC)
:Thanks for your help.Seems like Windows 7 adds 2 bytes extra to the file size so I had problems.I managed to get iTunes SHSH Request and found that the Info tag,BBTicket Value & APTicket Value is not needed--[[User:Sn0wra1n|Sn0wra1n]] 09:26, 22 December 2010 (UTC)

==Baseband SHSH Protocol==
Seems like there is a Baseband SHSH Protocol too. Maybe someone should write a wiki page on it. Im trying to understand notcom's [http://www.github.com/iSn0wra1n/TinyUmbrella TinyUmbrella code] --[[User:Whiteshinyapple|Whiteshinyapple]] 13:52, 9 March 2011 (UTC)
:You're right that we need an article for the [[Baseband SHSH Protocol]] also. I initially created this page here. You just have to log what goes over the network. You could also easily trace what gets send to [[TinyUmbrella]] for the baseband, but you cannot trace the official answer from Apple unless you upgrade the baseband (or reinstall it). So you need a device with an already upgraded baseband. My iPhone 4 is still running [[1.59.00]], so I cannot test that. But you're right, the next time I do a restore, I'll document at least the request that goes out (unless somebody else is faster). -- [[User:Http|http]] 22:14, 9 March 2011 (UTC)

Talk:XMM6180

2010-06-21T19:35:38Z

Miketress: Uses "strings" on new baseband of iPhone4

Are we sure this is the baseband?

The infineon spec-sheet says "HSDPA/HSUPA capabilities of 7.2Mbps/2.9Mbps".

At the keynote Steve mentioned 5.8Mbps HSUPA.
[[User:Iemit737|Iemit737]] 19:26, 21 June 2010 (UTC)

Running "string" on the new baseband files shows "XGold 618" multiple times.
--[[User:Miketress|Miketress]] 19:35, 21 June 2010 (UTC)

XMM6180

2010-06-21T19:09:56Z

Miketress: New page: This is the baseband processor used in the iPhone 4.

This is the baseband processor used in the iPhone 4.

The iPhone Wiki - User contributions [en]

Talk:SHSH Protocol

Talk:XMM6180

XMM6180