The iPhone Wiki - User contributions [en]

Activation Token

2012-05-13T20:47:38Z

Vasfed: /* Layout of Activation Token */

==Layout of Activation Token==
This is the [[wikipedia:Core Foundation|CFDictionary]] string representation which gets sent to Apple's server.The object can be obtained by using the [[MobileDevice Library]], AMDeviceCopyValue function with the "ActivationInfo" value.

It is generated by [[lockdownd]]. Upon generation it stores ActivationRandomness in data ark and later checks it, thus only the last generated token it valid. SHA1 is generated in lockdown and then it makes a request to [[fairplayd]] to complete signature process and obtain certificate chain.
<dict>
<key>ActivationInfoComplete</key>
<true/>
<key>ActivationInfoXML</key>
<data>
(base64-encoded activation info here)
</data>
<key>FairPlayCertChain</key>
<data>
(base64-encoded RSA certificate chain including root CA in DER format)
</data>
<key>FairPlaySignature</key>
<data>
(base64-encoded signature (SHA1+RSA) of ActivationInfoXML, validated using FairPlayCertChain certificate)
</data>
</dict>

===Key: ActivationInfoXML===
The ActivationInfo plist file above has a key called ActivationInfoXML. The base64 data value of that key represents the plist file below

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>ActivationRandomness</key>
<string>(GUID)</string>
<key>ActivationRequiresActivationTicket</key>
<true/>
<key>ActivationState</key>
<string>Unactivated</string>
<key>BasebandMasterKeyHash</key>
<string>(Hash of hardware IDs)<string>
<key>[[Baseband TEA Keys#Hardware Thumbprint Generation|BasebandThumbprint]]</key>
<string>(Hash of hardware IDs not directly used as a key - the TEA key can be derived from this)<string>
<key>BuildVersion</key>
<string>8A306</string>
<key>DeviceCertRequest</key>
<data>
(base64 encoded cert)
</data>
<key>DeviceClass</key>
<string>(String ENUM "iPhone", "iPod", "iPod touch", "iPad")</string>
<key>IntegratedCircuitCardIdentity</key>
<string>(ICCID as base-10 string)</string>
<key>InternationalMobileEquipmentIdentity</key>
<string>(IMEI as base-10 string)</string>
<key>InternationalMobileSubscriberIdentity</key>
<string>(IMSI as base-10 string)</string>
<key>ModelNumber</key>
<string>MC135</string>
<key>PhoneNumber</key>
<string>(String like "+1 (555) 555-5555")</string>
<key>ProductType</key>
<string>iPhone2,1</string>
<key>ProductVersion</key>
<string>4.0.1</string>
<string>SIMGID1</string>
<data>
(base64-encoded binary GID1)
</data>
<string>SIMGID2</string>
<data>
(base64-encoded binary GID2)
</data>
<key>SIMStatus</key>
<string>(ENUM kCTSIMSupportSIMStatusReady kCTSIMSupportSIMStatusNotReady kCTSIMSupportSIMStatusOperatorLocked)</string>
<key>SerialNumber</key>
<string>...</string>
<key>SupportsPostponement</key>
<true/>
<key>UniqueChipID</key>
<integer>...</integer>
<key>UniqueDeviceID</key>
<string>(hex UUID)</string>
</dict>
</plist>

SIMGIDs and PhoneNumber are present only if installed SIM has them and it was read correctly.

If ActivationState is not Unactivated or token signature is not correct, apple server will respond with message "there's probled with your device".

==Activation Protocol==
Use SSL and send the request below with the values
POST /WebObjects/ALUnbrick.woa/wa/deviceActivation HTTP/1.1
Accept-Encoding: gzip
Accept-Language: en-us, en;q=0.50
Content-Type: multipart/form-data; boundary=DeviceActivation
Content-Length: 1234
Host: albert.apple.com
Cache-Control: no-cache

--DeviceActivation
Content-Disposition: form-data; name="activation-info"

<dict>
<key>ActivationInfoComplete</key>
<true/>
<key>ActivationInfoXML</key>
<data>
(base64-encoded activation info here)
</data>
<key>FairPlayCertChain</key>
<data>
(base64-encoded cert in DER format)
</data>
<key>FairPlaySignature</key>
<data>
(base64-encoded signature (SHA1+RSA) of ActivationInfoXML)
</data>
</dict>

==Resources==
* [[User:posixninja|posixninja]]'s [http://github.com/posixninja/ideviceactivate iDeviceActivate]
* [[User:sn0wra1n|iSn0wra1n]]'s [http://github.com/iSn0wra1n/iActivator iActivator v2 for Windows]

[[Category:Baseband]]

Activation Token

2012-05-13T20:46:43Z

Vasfed: /* Key: ActivationInfoXML */

==Layout of Activation Token==
This is the [[wikipedia:Core Foundation|CFDictionary]] string representation which gets sent to Apple's server.The object can be obtained by using the [[MobileDevice Library]], AMDeviceCopyValue function with the "ActivationInfo" value.

It is generated by [[lockdownd]]. Upon generation it stores ActivationRandomness in data ark and later checks it, thus only the last generated token it valid. SHA1 is generated in lockdown and then it makes a request to [[fairplayd]] to complete signature process and obtain certificate chain.
<dict>
<key>ActivationInfoComplete</key>
<true/>
<key>ActivationInfoXML</key>
<data>
(base64-encoded activation info here)
</data>
<key>FairPlayCertChain</key>
<data>
(base64-encoded SSL certificate chain including root CA in DER format)
</data>
<key>FairPlaySignature</key>
<data>
(base64-encoded signature (SHA1+RSA) of ActivationInfoXML, validated using FairPlayCertChain certificate)
</data>
</dict>

===Key: ActivationInfoXML===
The ActivationInfo plist file above has a key called ActivationInfoXML. The base64 data value of that key represents the plist file below

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>ActivationRandomness</key>
<string>(GUID)</string>
<key>ActivationRequiresActivationTicket</key>
<true/>
<key>ActivationState</key>
<string>Unactivated</string>
<key>BasebandMasterKeyHash</key>
<string>(Hash of hardware IDs)<string>
<key>[[Baseband TEA Keys#Hardware Thumbprint Generation|BasebandThumbprint]]</key>
<string>(Hash of hardware IDs not directly used as a key - the TEA key can be derived from this)<string>
<key>BuildVersion</key>
<string>8A306</string>
<key>DeviceCertRequest</key>
<data>
(base64 encoded cert)
</data>
<key>DeviceClass</key>
<string>(String ENUM "iPhone", "iPod", "iPod touch", "iPad")</string>
<key>IntegratedCircuitCardIdentity</key>
<string>(ICCID as base-10 string)</string>
<key>InternationalMobileEquipmentIdentity</key>
<string>(IMEI as base-10 string)</string>
<key>InternationalMobileSubscriberIdentity</key>
<string>(IMSI as base-10 string)</string>
<key>ModelNumber</key>
<string>MC135</string>
<key>PhoneNumber</key>
<string>(String like "+1 (555) 555-5555")</string>
<key>ProductType</key>
<string>iPhone2,1</string>
<key>ProductVersion</key>
<string>4.0.1</string>
<string>SIMGID1</string>
<data>
(base64-encoded binary GID1)
</data>
<string>SIMGID2</string>
<data>
(base64-encoded binary GID2)
</data>
<key>SIMStatus</key>
<string>(ENUM kCTSIMSupportSIMStatusReady kCTSIMSupportSIMStatusNotReady kCTSIMSupportSIMStatusOperatorLocked)</string>
<key>SerialNumber</key>
<string>...</string>
<key>SupportsPostponement</key>
<true/>
<key>UniqueChipID</key>
<integer>...</integer>
<key>UniqueDeviceID</key>
<string>(hex UUID)</string>
</dict>
</plist>

SIMGIDs and PhoneNumber are present only if installed SIM has them and it was read correctly.

If ActivationState is not Unactivated or token signature is not correct, apple server will respond with message "there's probled with your device".

==Activation Protocol==
Use SSL and send the request below with the values
POST /WebObjects/ALUnbrick.woa/wa/deviceActivation HTTP/1.1
Accept-Encoding: gzip
Accept-Language: en-us, en;q=0.50
Content-Type: multipart/form-data; boundary=DeviceActivation
Content-Length: 1234
Host: albert.apple.com
Cache-Control: no-cache

--DeviceActivation
Content-Disposition: form-data; name="activation-info"

<dict>
<key>ActivationInfoComplete</key>
<true/>
<key>ActivationInfoXML</key>
<data>
(base64-encoded activation info here)
</data>
<key>FairPlayCertChain</key>
<data>
(base64-encoded cert in DER format)
</data>
<key>FairPlaySignature</key>
<data>
(base64-encoded signature (SHA1+RSA) of ActivationInfoXML)
</data>
</dict>

==Resources==
* [[User:posixninja|posixninja]]'s [http://github.com/posixninja/ideviceactivate iDeviceActivate]
* [[User:sn0wra1n|iSn0wra1n]]'s [http://github.com/iSn0wra1n/iActivator iActivator v2 for Windows]

[[Category:Baseband]]

Activation Token

2012-05-13T20:41:58Z

Vasfed: /* Layout Activation Token */

==Layout of Activation Token==
This is the [[wikipedia:Core Foundation|CFDictionary]] string representation which gets sent to Apple's server.The object can be obtained by using the [[MobileDevice Library]], AMDeviceCopyValue function with the "ActivationInfo" value.

It is generated by [[lockdownd]]. Upon generation it stores ActivationRandomness in data ark and later checks it, thus only the last generated token it valid. SHA1 is generated in lockdown and then it makes a request to [[fairplayd]] to complete signature process and obtain certificate chain.
<dict>
<key>ActivationInfoComplete</key>
<true/>
<key>ActivationInfoXML</key>
<data>
(base64-encoded activation info here)
</data>
<key>FairPlayCertChain</key>
<data>
(base64-encoded SSL certificate chain including root CA in DER format)
</data>
<key>FairPlaySignature</key>
<data>
(base64-encoded signature (SHA1+RSA) of ActivationInfoXML, validated using FairPlayCertChain certificate)
</data>
</dict>

===Key: ActivationInfoXML===
The ActivationInfo plist file above has a key called ActivationInfoXML. The base64 data value of that key represents the plist file below

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>ActivationRandomness</key>
<string>(GUID)</string>
<key>ActivationRequiresActivationTicket</key>
<true/>
<key>ActivationState</key>
<string>Unactivated</string>
<key>BasebandMasterKeyHash</key>
<string>(Hash of hardware IDs)<string>
<key>[[Baseband TEA Keys#Hardware Thumbprint Generation|BasebandThumbprint]]</key>
<string>(Hash of hardware IDs not directly used as a key - the TEA key can be derived from this)<string>
<key>BuildVersion</key>
<string>8A306</string>
<key>DeviceCertRequest</key>
<data>
(base64 encoded cert)
</data>
<key>DeviceClass</key>
<string>(String ENUM "iPhone", "iPod", "iPod touch", "iPad")</string>
<key>IntegratedCircuitCardIdentity</key>
<string>(ICCID as base-10 string)</string>
<key>InternationalMobileEquipmentIdentity</key>
<string>(IMEI as base-10 string)</string>
<key>InternationalMobileSubscriberIdentity</key>
<string>(IMSI as base-10 string)</string>
<key>ModelNumber</key>
<string>MC135</string>
<key>PhoneNumber</key>
<string>(String like "+1 (555) 555-5555")</string>
<key>ProductType</key>
<string>iPhone2,1</string>
<key>ProductVersion</key>
<string>4.0.1</string>
<string>SIMGID1</string>
<data>
(base64-encoded binary GID1)
</data>
<string>SIMGID2</string>
<data>
(base64-encoded binary GID2)
</data>
<key>SIMStatus</key>
<string>(ENUM kCTSIMSupportSIMStatusReady kCTSIMSupportSIMStatusNotReady kCTSIMSupportSIMStatusOperatorLocked)</string>
<key>SerialNumber</key>
<string>...</string>
<key>SupportsPostponement</key>
<true/>
<key>UniqueChipID</key>
<integer>...</integer>
<key>UniqueDeviceID</key>
<string>(hex UUID)</string>
</dict>
</plist>

==Activation Protocol==
Use SSL and send the request below with the values
POST /WebObjects/ALUnbrick.woa/wa/deviceActivation HTTP/1.1
Accept-Encoding: gzip
Accept-Language: en-us, en;q=0.50
Content-Type: multipart/form-data; boundary=DeviceActivation
Content-Length: 1234
Host: albert.apple.com
Cache-Control: no-cache

--DeviceActivation
Content-Disposition: form-data; name="activation-info"

<dict>
<key>ActivationInfoComplete</key>
<true/>
<key>ActivationInfoXML</key>
<data>
(base64-encoded activation info here)
</data>
<key>FairPlayCertChain</key>
<data>
(base64-encoded cert in DER format)
</data>
<key>FairPlaySignature</key>
<data>
(base64-encoded signature (SHA1+RSA) of ActivationInfoXML)
</data>
</dict>

==Resources==
* [[User:posixninja|posixninja]]'s [http://github.com/posixninja/ideviceactivate iDeviceActivate]
* [[User:sn0wra1n|iSn0wra1n]]'s [http://github.com/iSn0wra1n/iActivator iActivator v2 for Windows]

[[Category:Baseband]]

Talk:SHSH Protocol

2010-08-26T09:41:28Z

Vasfed: /* Implementation */

== Naming ==
Or should I better have named this '''TSS Protocol''' instead? -- [[User:Http|http]] 21:23, 15 August 2010 (UTC)

I think the current title is easier to tell it relates to shsh. I can't recall what tss stands for, and I think it would also be easier to find. [[User:Iemit737|Iemit737]] 21:36, 15 August 2010 (UTC)

== Implementation ==

How can I implement this on a Linux-based system? I have the request, but the 'telnet' and 'POST' commands don't work. --[[User:Dra1nerdrake|dra1nerdrake]] 22:40, 15 August 2010 (UTC)

Telnet should work. Just enter
telnet gs.apple.com 80
Then you get a HTTP connection. Then send the request and terminate with two CR/LF and you get the response. You can try with any other web page first, that should work the same way:
telnet www.google.com 80
Then:
GET / HTTP/1.0

And didn't [[User:Semaphore|semaphore]] release a unix version with some source code of [[TinyUmbrella]]? -- [[User:Http|http]] 23:49, 15 August 2010 (UTC)

Great, thanks, forgot the port number. He released unix TinyUmbrella, but it segfaults and I can't code in Java. --[[User:Dra1nerdrake|dra1nerdrake]] 04:18, 16 August 2010 (UTC)

EDIT: I can't seem to get it to work. I do:
telnet cydia.saurik.com 80
Then I do
POST /TSS/controller?action=2 HTTP/1.1
Accept: */*
Cache-Control: no-cache
Content-type: text/xml; charset="utf-8"
User-Agent: InetURL/1.0
Content-Length: 411
Host: gs.apple.com

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>@HostIpAddress</key>
<string>192.168.0.1</string>
<key>@HostPlatformInfo</key>
<string>darwin</string>
<key>@VersionInfo</key>
<string>3.8</string>
<key>@Locality</key>
<string>en_US</string>
<key>ApProductionMode</key>
<true/>
<key>ApECID</key>
<string>1430661561679</string>
<key>ApChipID</key>
<integer>35106</integer>
<key>ApBoardID</key>
<integer>2</integer>
<key>ApSecurityDomain</key>
<integer>1</integer>
<key>UniqueBuildID</key>
<data>
uvWKIop3L16LfQymS8IyiDZXXw0=
</data>
<key>AppleLogo</key>
<dict>
<key>Digest</key>
<data>
kK7SLPJWvaq+GAn9Dm/sG6aJjXg=
</data>
<key>Info</key>
<dict>
<key>IsFirmwarePayload</key>
<true/>
<key>Path</key>
<string>Firmware/all_flash/all_flash.n18ap.production/applelogo.s5l8922x.img3</string>
</dict>
<key>PartialDigest</key>
<data>
QAAAAHgdAADDPQY07wMJ1z2qVSjKuM4iqjhFKw==
</data>
<key>Trusted</key>
<true/>
</dict>
<key>BatteryCharging</key>
<dict>
<key>Digest</key>
<data>
lvxtYniO/PKy46ZZV0YIe9ZeNt0=
</data>
<key>Info</key>
<dict>
<key>IsFirmwarePayload</key>
<true/>
<key>Path</key>
<string>Firmware/all_flash/all_flash.n18ap.production/glyphcharging.s5l8922x.img3</string>
</dict>
<key>PartialDigest</key>
<data>
QAAAAHhHAADPFoOCbp1jZBqTtFlCT3XE/qYkKw==
</data>
<key>Trusted</key>
<true/>
</dict>
<key>BatteryCharging0</key>
<dict>
<key>Digest</key>
<data>
+o+lH7zqvh90+/cRCjNeSmTsNvU=
</data>
<key>Info</key>
<dict>
<key>IsFirmwarePayload</key>
<true/>
<key>Path</key>
<string>Firmware/all_flash/all_flash.n18ap.production/batterycharging0.s5l8922x.img3</string>
</dict>
<key>PartialDigest</key>
<data>
QAAAAPhEAADGKdYO2peJTZrXjeitEdUEMiC8hw==
</data>
<key>Trusted</key>
<true/>
</dict>
<key>BatteryCharging1</key>
<dict>
<key>Digest</key>
<data>
u7NDP6MdWuEGT5Q4Qsm/OrsGTuE=
</data>
<key>Info</key>
<dict>
<key>IsFirmwarePayload</key>
<true/>
<key>Path</key>
<string>Firmware/all_flash/all_flash.n18ap.production/batterycharging1.s5l8922x.img3</string>
</dict>
<key>PartialDigest</key>
<data>
QAAAADhZAAAWwQq0Y75xTjOyQ9gxMVNrczF01g==
</data>
<key>Trusted</key>
<true/>
</dict>
<key>BatteryFull</key>
<dict>
<key>Digest</key>
<data>
fTK7DLd3XJTHX9ywLJy97+VeUN0=
</data>
<key>Info</key>
<dict>
<key>IsFirmwarePayload</key>
<true/>
<key>Path</key>
<string>Firmware/all_flash/all_flash.n18ap.production/batteryfull.s5l8922x.img3</string>
</dict>
<key>PartialDigest</key>
<data>
QAAAADghAQDNQ9aqlsb/szaE/5Xh9OJF1WIhxw==
</data>
<key>Trusted</key>
<true/>
</dict>
<key>BatteryLow0</key>
<dict>
<key>Digest</key>
<data>
rdMyyO2tICLCLzvxY05lirfWrzQ=
</data>
<key>Info</key>
<dict>
<key>IsFirmwarePayload</key>
<true/>
<key>Path</key>
<string>Firmware/all_flash/all_flash.n18ap.production/batterylow0.s5l8922x.img3</string>
</dict>
<key>PartialDigest</key>
<data>
QAAAALjVAAB7wuaDZva7tC1CGWUl4ATOZ7aUbA==
</data>
<key>Trusted</key>
<true/>
</dict>
<key>BatteryLow1</key>
<dict>
<key>Digest</key>
<data>
ecfArQo2Cxly0h6D7iYT9TLKSSE=
</data>
<key>Info</key>
<dict>
<key>IsFirmwarePayload</key>
<true/>
<key>Path</key>
<string>Firmware/all_flash/all_flash.n18ap.production/batterylow1.s5l8922x.img3</string>
</dict>
<key>PartialDigest</key>
<data>
QAAAAPj2AAABqpmcEB9sOeTSulytXfC8KWZU9g==
</data>
<key>Trusted</key>
<true/>
</dict>
<key>BatteryPlugin</key>
<dict>
<key>Digest</key>
<data>
MtXc08RsYs+6BMhD4kY0quNr/AU=
</data>
<key>Info</key>
<dict>
<key>IsFirmwarePayload</key>
<true/>
<key>Path</key>
<string>Firmware/all_flash/all_flash.n18ap.production/glyphplugin.s5l8922x.img3</string>
</dict>
<key>PartialDigest</key>
<data>
QAAAAHhDAABQJN3XJEBkNhnJqv6Ra2zBYJeuoQ==
</data>
<key>Trusted</key>
<true/>
</dict>
<key>DeviceTree</key>
<dict>
<key>Digest</key>
<data>
ngiLrFM16Bg/BkPkmqf59h3H90c=
</data>
<key>Info</key>
<dict>
<key>IsFirmwarePayload</key>
<true/>
<key>Path</key>
<string>Firmware/all_flash/all_flash.n18ap.production/DeviceTree.n18ap.img3</string>
</dict>
<key>PartialDigest</key>
<data>
QAAAALiDAABl290rfckYS+L3TjGRA7j8avdgDg==
</data>
<key>Trusted</key>
<true/>
</dict>
<key>KernelCache</key>
<dict>
<key>Digest</key>
<data>
F978uz3zV6USmE34FMmm6xeQDwU=
</data>
<key>Info</key>
<dict>
<key>Path</key>
<string>kernelcache.release.s5l8922x</string>
</dict>
<key>PartialDigest</key>
<data>
QAAAALhxPQDOpPhRPAe/mVP5J89iIhtaQEmJgg==
</data>
<key>Trusted</key>
<true/>
</dict>
<key>LLB</key>
<dict>
<key>BuildString</key>
<string>iBoot-636.66~5</string>
<key>Info</key>
<dict>
<key>IsFirmwarePayload</key>
<true/>
<key>Path</key>
<string>Firmware/all_flash/all_flash.n18ap.production/LLB.n18ap.RELEASE.img3</string>
</dict>
<key>PartialDigest</key>
<data>
QAAAADgxAQDkevEFsIGKqarjmv9T7avG8oGXhg==
</data>
</dict>
<key>NeedService</key>
<dict>
<key>Digest</key>
<data>
klkKn9XNikUb9bdtVU7b2yv9OYc=
</data>
<key>Info</key>
<dict>
<key>IsFirmwarePayload</key>
<true/>
<key>Path</key>
<string>Firmware/all_flash/all_flash.n18ap.production/needservice.s5l8922x.img3</string>
</dict>
<key>PartialDigest</key>
<data>
QAAAALhHAACO1eYCz8W9YsCQ5OT1T0CFHk+aHQ==
</data>
<key>Trusted</key>
<true/>
</dict>
<key>OS</key>
<dict>
<key>Info</key>
<dict>
<key>Path</key>
<string>018-6152-014.dmg</string>
</dict>
</dict>
<key>RecoveryMode</key>
<dict>
<key>Digest</key>
<data>
DjD6JMIq4Qnnsay14L3jL+AdxPs=
</data>
<key>Info</key>
<dict>
<key>IsFirmwarePayload</key>
<true/>
<key>Path</key>
<string>Firmware/all_flash/all_flash.n18ap.production/recoverymode.s5l8922x.img3</string>
</dict>
<key>PartialDigest</key>
<data>
QAAAAPiyAABju7ZnxiRutww2vcmjIIlXG4KSAA==
</data>
<key>Trusted</key>
<true/>
</dict>
<key>RestoreDeviceTree</key>
<dict>
<key>Digest</key>
<data>
ngiLrFM16Bg/BkPkmqf59h3H90c=
</data>
<key>Info</key>
<dict>
<key>Path</key>
<string>Firmware/all_flash/all_flash.n18ap.production/DeviceTree.n18ap.img3</string>
</dict>
<key>PartialDigest</key>
<data>
QAAAALiDAABl290rfckYS+L3TjGRA7j8avdgDg==
</data>
<key>Trusted</key>
<true/>
</dict>
<key>RestoreKernelCache</key>
<dict>
<key>Digest</key>
<data>
F978uz3zV6USmE34FMmm6xeQDwU=
</data>
<key>Info</key>
<dict>
<key>Path</key>
<string>kernelcache.release.s5l8922x</string>
</dict>
<key>PartialDigest</key>
<data>
QAAAALhxPQDOpPhRPAe/mVP5J89iIhtaQEmJgg==
</data>
<key>Trusted</key>
<true/>
</dict>
<key>RestoreLogo</key>
<dict>
<key>Digest</key>
<data>
kK7SLPJWvaq+GAn9Dm/sG6aJjXg=
</data>
<key>Info</key>
<dict>
<key>Path</key>
<string>Firmware/all_flash/all_flash.n18ap.production/applelogo.s5l8922x.img3</string>
</dict>
<key>PartialDigest</key>
<data>
QAAAAHgdAADDPQY07wMJ1z2qVSjKuM4iqjhFKw==
</data>
<key>Trusted</key>
<true/>
</dict>
<key>RestoreRamDisk</key>
<dict>
<key>Digest</key>
<data>
20tqZkEp1wApx1tz+ZCP38axvHE=
</data>
<key>Info</key>
<dict>
<key>Path</key>
<string>018-6145-014.dmg</string>
</dict>
<key>PartialDigest</key>
<data>
QAAAAPjQuwAyMjwJWKpL0b8bUzYKajbbPEVuPA==
</data>
<key>Trusted</key>
<true/>
</dict>
<key>iBEC</key>
<dict>
<key>BuildString</key>
<string>iBoot-636.66~5</string>
<key>Info</key>
<dict>
<key>Path</key>
<string>Firmware/dfu/iBEC.n18ap.RELEASE.dfu</string>
</dict>
<key>PartialDigest</key>
<data>
QAAAADjRAQDQA4xYDDo21pS9j57YWeGp6l/TvA==
</data>
</dict>
<key>iBSS</key>
<dict>
<key>BuildString</key>
<string>iBoot-636.66~5</string>
<key>Info</key>
<dict>
<key>Path</key>
<string>Firmware/dfu/iBSS.n18ap.RELEASE.dfu</string>
</dict>
<key>PartialDigest</key>
<data>
QAAAADjRAQA2J3DDdRv+TmjaGodpeT634g/Haw==
</data>
</dict>
<key>iBoot</key>
<dict>
<key>Digest</key>
<data>
soCT6YL1cig/OKRvbam3igRcvaQ=
</data>
<key>Info</key>
<dict>
<key>IsFirmwarePayload</key>
<true/>
<key>Path</key>
<string>Firmware/all_flash/all_flash.n18ap.production/iBoot.n18ap.RELEASE.img3</string>
</dict>
<key>PartialDigest</key>
<data>
QAAAADihAgB46rf/axQHtuftGLR8SDpdOuOywA==
</data>
<key>Trusted</key>
<true/>
</dict>
</dict>
</plist>
<CR><LF>
<CR><LF>
But no dice. --[[User:Dra1nerdrake|dra1nerdrake]] 18:33, 16 August 2010 (UTC)
----
*I think your main problem is that your content is more than the 411 bytes that you specified.
*Where do you have the digest etc. values from?
*In my article I didn't write about the Info key you added. What is that?
-- [[User:Http|http]] 20:45, 16 August 2010 (UTC)

I copied the entire plist from a plist generated by [[idevicerestore]]. Digest values are from the buildmanifest.plist, at the root directory of the firmware. I ran it in debug mode (-d). What should I put in place of 411? --[[User:Dra1nerdrake|dra1nerdrake]] 02:12, 17 August 2010 (UTC)

It should be the size of the data you transfer. The data seems to be much longer than 411 bytes, I didn't count though. See section 14.13 [http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html here (RFC2616)]. --[[User:Http|http]] 03:56, 17 August 2010 (UTC)

Did it finally work for you? Also: Do you know how [[idevicerestore]] creates these Digest values? If you find that out, maybe you can update the article. -- [[User:Http|http]] 22:42, 24 August 2010 (UTC)

Curl is more suitable for LL HTTP, try something like:
<pre>
$ curl -v "http://cydia.saurik.com/TSS/controller?action=2" -X POST -d @1.plist -H "Host: gs.apple.com" -H "Content-type: text/xml; charset=utf8"
* About to connect() to cydia.saurik.com port 80 (#0)
* Trying 74.208.10.249... connected
* Connected to cydia.saurik.com (74.208.10.249) port 80 (#0)
> POST /TSS/controller?action=2 HTTP/1.1
> User-Agent: curl/7.19.7 (universal-apple-darwin10.0) libcurl/7.19.7 OpenSSL/0.9.8l zlib/1.2.3
> Accept: */*
> Host: gs.apple.com
> Content-type: text/xml; charset=utf8
> Content-Length: 8222
> Expect: 100-continue
>
< HTTP/1.1 100 Continue
< HTTP/1.1 200 OK
< Server: nginx/0.7.64
< Date: Thu, 26 Aug 2010 09:27:56 GMT
< Content-Type: text/plain
< Transfer-Encoding: chunked
< Connection: keep-alive
< Cache-Control: private, proxy-revalidate
<
STATUS=94&MESSAGE=This device isn't eligible for the requested build.
* Connection #0 to host cydia.saurik.com left intact
* Closing connection #0
</pre>
where 1.plist is a file with your plist
--[[User:Vasfed|Vasfed]] 09:41, 26 August 2010 (UTC)

== Request? ==
I'm still not understanding the telnet part of this. I can connect fine, but what exactly is the request that I have to send in order to get back a plist file with the SHSH blobs? --[[User:Cool name|Cool name]] 04:08, 16 August 2010 (UTC)