sneak/hacks
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

initial code for dumping imessages in a reasonable format

Browse Source
This commit is contained in:
Jeffrey Paul
2014-02-09 00:30:49 +01:00
parent c0021efb13
commit 9dd7628f04
157 changed files with 24178 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

42
dump-imessages/iphone-dataprotection/emf_decrypter/emf/emf.h Normal file
View File

@@ -0,0 +1,42 @@
//As of iOS 4, class keys 1 to 4 are used for files, class 5 usage is unknown
#define MAX_CLASS_KEYS 5
#define CLASS_DKEY 4
typedef struct EMFInfo
{
Volume* volume;
uint64_t volume_id;
uint64_t volume_offset;
uint32_t classKeys_bitset;
AES_KEY emfkey;
AES_KEY classKeys[MAX_CLASS_KEYS];
}EMFInfo;
EMFInfo* EMF_init(Volume*, char*);
#define CPROTECT_V2_LENGTH 0x38 //56
#define CP_WRAPPEDKEYSIZE 40 /* 2x4 = 8, 8x8 = 64 */
//http://www.opensource.apple.com/source/xnu/xnu-1699.22.73/bsd/sys/cprotect.h
typedef struct cprotect_xattr_v2
{
uint16_t xattr_major_version; // =2
uint16_t xattr_minor_version; // =0
uint32_t flags; // leaks stack dword in one code path (cp_handle_vnop)
uint32_t persistent_class;
uint32_t key_size; //0x28
uint8_t persistent_key[0x28];
} cprotect_xattr_v2;
#define CPROTECT_V4_LENGTH 0x4C //76
typedef struct cprotect_xattr_v4
{
uint16_t xattr_major_version; // =4
uint16_t xattr_minor_version; // =0
uint32_t xxx_length; // 0xc
uint32_t protection_class_id;
uint32_t wrapped_length; //0x28
uint8_t xxx_junk[20]; //uninitialized ?
uint8_t wrapped_key[0x28];
} cprotect_xattr_v4;