sneak/hacks
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

initial code for dumping imessages in a reasonable format

Browse Source
This commit is contained in:
Jeffrey Paul
2014-02-09 00:30:49 +01:00
parent c0021efb13
commit 9dd7628f04
157 changed files with 24178 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

342
dump-imessages/iphone-dataprotection/emf_decrypter/includes/dmg/dmg.h Normal file
View File

@@ -0,0 +1,342 @@
#ifndef DMG_H
#define DMG_H
#include <stdlib.h>
#include <stdint.h>
#include <stdio.h>
#include <hfs/hfsplus.h>
#include "abstractfile.h"
#define CHECKSUM_CRC32 0x00000002
#define CHECKSUM_MKBLOCK 0x0002
#define CHECKSUM_NONE 0x0000
#define BLOCK_ZLIB 0x80000005
#define BLOCK_RAW 0x00000001
#define BLOCK_IGNORE 0x00000002
#define BLOCK_COMMENT 0x7FFFFFFE
#define BLOCK_TERMINATOR 0xFFFFFFFF
#define SECTOR_SIZE 512
#define DRIVER_DESCRIPTOR_SIGNATURE 0x4552
#define APPLE_PARTITION_MAP_SIGNATURE 0x504D
#define UDIF_BLOCK_SIGNATURE 0x6D697368
#define KOLY_SIGNATURE 0x6B6F6C79
#define HFSX_SIGNATURE 0x4858
#define ATTRIBUTE_HDIUTIL 0x0050
#define HFSX_VOLUME_TYPE "Apple_HFSX"
#define DDM_SIZE 0x1
#define PARTITION_SIZE 0x3f
#define ATAPI_SIZE 0x8
#define FREE_SIZE 0xa
#define EXTRA_SIZE (ATAPI_OFFSET + ATAPI_SIZE + FREE_SIZE)
#define DDM_OFFSET 0x0
#define PARTITION_OFFSET (DDM_SIZE)
#define ATAPI_OFFSET 64
#define USER_OFFSET (ATAPI_OFFSET + ATAPI_SIZE)
#define BOOTCODE_DMMY 0x444D4D59
#define BOOTCODE_GOON 0x676F6F6E
enum {
kUDIFFlagsFlattened = 1
};
enum {
kUDIFDeviceImageType = 1,
kUDIFPartitionImageType = 2
};
typedef struct {
uint32_t type;
uint32_t size;
uint32_t data[0x20];
} __attribute__((__packed__)) UDIFChecksum;
typedef struct {
uint32_t data1; /* smallest */
uint32_t data2;
uint32_t data3;
uint32_t data4; /* largest */
} __attribute__((__packed__)) UDIFID;
typedef struct {
uint32_t fUDIFSignature;
uint32_t fUDIFVersion;
uint32_t fUDIFHeaderSize;
uint32_t fUDIFFlags;
uint64_t fUDIFRunningDataForkOffset;
uint64_t fUDIFDataForkOffset;
uint64_t fUDIFDataForkLength;
uint64_t fUDIFRsrcForkOffset;
uint64_t fUDIFRsrcForkLength;
uint32_t fUDIFSegmentNumber;
uint32_t fUDIFSegmentCount;
UDIFID fUDIFSegmentID; /* a 128-bit number like a GUID, but does not seem to be a OSF GUID, since it doesn't have the proper versioning byte */
UDIFChecksum fUDIFDataForkChecksum;
uint64_t fUDIFXMLOffset;
uint64_t fUDIFXMLLength;
uint8_t reserved1[0x78]; /* this is actually the perfect amount of space to store every thing in this struct until the checksum */
UDIFChecksum fUDIFMasterChecksum;
uint32_t fUDIFImageVariant;
uint64_t fUDIFSectorCount;
uint32_t reserved2;
uint32_t reserved3;
uint32_t reserved4;
} __attribute__((__packed__)) UDIFResourceFile;
typedef struct {
uint32_t type;
uint32_t reserved;
uint64_t sectorStart;
uint64_t sectorCount;
uint64_t compOffset;
uint64_t compLength;
} __attribute__((__packed__)) BLKXRun;
typedef struct {
uint16_t version; /* set to 5 */
uint32_t isHFS; /* first dword of v53(ImageInfoRec): Set to 1 if it's a HFS or HFS+ partition -- duh. */
uint32_t unknown1; /* second dword of v53: seems to be garbage if it's HFS+, stuff related to HFS embedded if it's that*/
uint8_t dataLen; /* length of data that proceeds, comes right before the data in ImageInfoRec. Always set to 0 for HFS, HFS+ */
uint8_t data[255]; /* other data from v53, dataLen + 1 bytes, the rest NULL filled... a string? Not set for HFS, HFS+ */
uint32_t unknown2; /* 8 bytes before volumeModified in v53, seems to be always set to 0 for HFS, HFS+ */
uint32_t unknown3; /* 4 bytes before volumeModified in v53, seems to be always set to 0 for HFS, HFS+ */
uint32_t volumeModified; /* offset 272 in v53 */
uint32_t unknown4; /* always seems to be 0 for UDIF */
uint16_t volumeSignature; /* HX in our case */
uint16_t sizePresent; /* always set to 1 */
} __attribute__((__packed__)) SizeResource;
typedef struct {
uint16_t version; /* set to 1 */
uint32_t type; /* set to 0x2 for MKBlockChecksum */
uint32_t checksum;
} __attribute__((__packed__)) CSumResource;
typedef struct NSizResource {
char isVolume;
unsigned char* sha1Digest;
uint32_t blockChecksum2;
uint32_t bytes;
uint32_t modifyDate;
uint32_t partitionNumber;
uint32_t version;
uint32_t volumeSignature;
struct NSizResource* next;
} NSizResource;
#define DDM_DESCRIPTOR 0xFFFFFFFF
#define ENTIRE_DEVICE_DESCRIPTOR 0xFFFFFFFE
typedef struct {
uint32_t fUDIFBlocksSignature;
uint32_t infoVersion;
uint64_t firstSectorNumber;
uint64_t sectorCount;
uint64_t dataStart;
uint32_t decompressBufferRequested;
uint32_t blocksDescriptor;
uint32_t reserved1;
uint32_t reserved2;
uint32_t reserved3;
uint32_t reserved4;
uint32_t reserved5;
uint32_t reserved6;
UDIFChecksum checksum;
uint32_t blocksRunCount;
BLKXRun runs[0];
} __attribute__((__packed__)) BLKXTable;
typedef struct {
uint32_t ddBlock;
uint16_t ddSize;
uint16_t ddType;
} __attribute__((__packed__)) DriverDescriptor;
typedef struct {
uint16_t pmSig;
uint16_t pmSigPad;
uint32_t pmMapBlkCnt;
uint32_t pmPyPartStart;
uint32_t pmPartBlkCnt;
unsigned char pmPartName[32];
unsigned char pmParType[32];
uint32_t pmLgDataStart;
uint32_t pmDataCnt;
uint32_t pmPartStatus;
uint32_t pmLgBootStart;
uint32_t pmBootSize;
uint32_t pmBootAddr;
uint32_t pmBootAddr2;
uint32_t pmBootEntry;
uint32_t pmBootEntry2;
uint32_t pmBootCksum;
unsigned char pmProcessor[16];
uint32_t bootCode;
uint16_t pmPad[186];
} __attribute__((__packed__)) Partition;
typedef struct {
uint16_t sbSig;
uint16_t sbBlkSize;
uint32_t sbBlkCount;
uint16_t sbDevType;
uint16_t sbDevId;
uint32_t sbData;
uint16_t sbDrvrCount;
uint32_t ddBlock;
uint16_t ddSize;
uint16_t ddType;
DriverDescriptor ddPad[0];
} __attribute__((__packed__)) DriverDescriptorRecord;
typedef struct ResourceData {
uint32_t attributes;
unsigned char* data;
size_t dataLength;
int id;
char* name;
struct ResourceData* next;
} ResourceData;
typedef void (*FlipDataFunc)(unsigned char* data, char out);
typedef void (*ChecksumFunc)(void* ckSum, const unsigned char* data, size_t len);
typedef struct ResourceKey {
unsigned char* key;
ResourceData* data;
struct ResourceKey* next;
FlipDataFunc flipData;
} ResourceKey;
#define SHA1_DIGEST_SIZE 20
typedef struct {
uint32_t state[5];
uint32_t count[2];
uint8_t buffer[64];
} SHA1_CTX;
typedef struct {
uint32_t block;
uint32_t crc;
SHA1_CTX sha1;
} ChecksumToken;
static inline uint32_t readUInt32(AbstractFile* file) {
uint32_t data;
ASSERT(file->read(file, &data, sizeof(data)) == sizeof(data), "fread");
FLIPENDIAN(data);
return data;
}
static inline void writeUInt32(AbstractFile* file, uint32_t data) {
FLIPENDIAN(data);
ASSERT(file->write(file, &data, sizeof(data)) == sizeof(data), "fwrite");
}
static inline uint32_t readUInt64(AbstractFile* file) {
uint64_t data;
ASSERT(file->read(file, &data, sizeof(data)) == sizeof(data), "fread");
FLIPENDIAN(data);
return data;
}
static inline void writeUInt64(AbstractFile* file, uint64_t data) {
FLIPENDIAN(data);
ASSERT(file->write(file, &data, sizeof(data)) == sizeof(data), "fwrite");
}
#ifdef __cplusplus
extern "C" {
#endif
void outResources(AbstractFile* file, AbstractFile* out);
uint32_t CRC32Checksum(uint32_t* crc, const unsigned char *buf, size_t len);
uint32_t MKBlockChecksum(uint32_t* ckSum, const unsigned char* data, size_t len);
void BlockSHA1CRC(void* token, const unsigned char* data, size_t len);
void BlockCRC(void* token, const unsigned char* data, size_t len);
void CRCProxy(void* token, const unsigned char* data, size_t len);
void SHA1Init(SHA1_CTX* context);
void SHA1Update(SHA1_CTX* context, const uint8_t* data, const size_t len);
void SHA1Final(uint8_t digest[SHA1_DIGEST_SIZE], SHA1_CTX* context);
void flipUDIFChecksum(UDIFChecksum* o, char out);
void readUDIFChecksum(AbstractFile* file, UDIFChecksum* o);
void writeUDIFChecksum(AbstractFile* file, UDIFChecksum* o);
void readUDIFID(AbstractFile* file, UDIFID* o);
void writeUDIFID(AbstractFile* file, UDIFID* o);
void readUDIFResourceFile(AbstractFile* file, UDIFResourceFile* o);
void writeUDIFResourceFile(AbstractFile* file, UDIFResourceFile* o);
ResourceKey* readResources(AbstractFile* file, UDIFResourceFile* resourceFile);
void writeResources(AbstractFile* file, ResourceKey* resources);
void releaseResources(ResourceKey* resources);
NSizResource* readNSiz(ResourceKey* resources);
ResourceKey* writeNSiz(NSizResource* nSiz);
void releaseNSiz(NSizResource* nSiz);
extern const char* plistHeader;
extern const char* plistFooter;
ResourceKey* getResourceByKey(ResourceKey* resources, const char* key);
ResourceData* getDataByID(ResourceKey* resource, int id);
ResourceKey* insertData(ResourceKey* resources, const char* key, int id, const char* name, const char* data, size_t dataLength, uint32_t attributes);
ResourceKey* makePlst();
ResourceKey* makeSize(HFSPlusVolumeHeader* volumeHeader);
void flipDriverDescriptorRecord(DriverDescriptorRecord* record, char out);
void flipPartition(Partition* partition, char out, unsigned int BlockSize);
void flipPartitionMultiple(Partition* partition, char multiple, char out, unsigned int BlockSize);
void readDriverDescriptorMap(AbstractFile* file, ResourceKey* resources);
DriverDescriptorRecord* createDriverDescriptorMap(uint32_t numSectors, unsigned int BlockSize);
int writeDriverDescriptorMap(int pNum, AbstractFile* file, DriverDescriptorRecord* DDM, unsigned int BlockSize, ChecksumFunc dataForkChecksum, void* dataForkToken, ResourceKey **resources);
void readApplePartitionMap(AbstractFile* file, ResourceKey* resources, unsigned int BlockSize);
Partition* createApplePartitionMap(uint32_t numSectors, const char* volumeType, unsigned int BlockSize);
int writeApplePartitionMap(int pNum, AbstractFile* file, Partition* partitions, unsigned int BlockSize, ChecksumFunc dataForkChecksum, void* dataForkToken, ResourceKey **resources, NSizResource** nsizIn);
int writeATAPI(int pNum, AbstractFile* file, unsigned int BlockSize, ChecksumFunc dataForkChecksum, void* dataForkToken, ResourceKey **resources, NSizResource** nsizIn);
int writeFreePartition(int pNum, AbstractFile* outFile, uint32_t offset, uint32_t numSectors, ResourceKey** resources);
void extractBLKX(AbstractFile* in, AbstractFile* out, BLKXTable* blkx);
BLKXTable* insertBLKX(AbstractFile* out, AbstractFile* in, uint32_t firstSectorNumber, uint32_t numSectors, uint32_t blocksDescriptor,
uint32_t checksumType, ChecksumFunc uncompressedChk, void* uncompressedChkToken, ChecksumFunc compressedChk,
void* compressedChkToken, Volume* volume, int addComment);
int extractDmg(AbstractFile* abstractIn, AbstractFile* abstractOut, int partNum);
int buildDmg(AbstractFile* abstractIn, AbstractFile* abstractOut, unsigned int BlockSize);
int convertToISO(AbstractFile* abstractIn, AbstractFile* abstractOut);
int convertToDMG(AbstractFile* abstractIn, AbstractFile* abstractOut);
#ifdef __cplusplus
}
#endif
#endif

21
dump-imessages/iphone-dataprotection/emf_decrypter/includes/dmg/dmgfile.h Normal file
View File

@@ -0,0 +1,21 @@
/*
* dmgfile.h
* libdmg-hfsplus
*
*/
#include <dmg/dmg.h>
io_func* openDmgFile(AbstractFile* dmg);
io_func* openDmgFilePartition(AbstractFile* dmg, int partition);
typedef struct DMG {
AbstractFile* dmg;
ResourceKey* resources;
uint32_t numBLKX;
BLKXTable** blkx;
void* runData;
uint64_t runStart;
uint64_t runEnd;
uint64_t offset;
} DMG;

19
dump-imessages/iphone-dataprotection/emf_decrypter/includes/dmg/dmglib.h Normal file
View File

@@ -0,0 +1,19 @@
#ifndef DMGLIB_H
#define DMGLIB_H
#include <dmg/dmg.h>
#include "abstractfile.h"
#ifdef __cplusplus
extern "C" {
#endif
int extractDmg(AbstractFile* abstractIn, AbstractFile* abstractOut, int partNum);
int buildDmg(AbstractFile* abstractIn, AbstractFile* abstractOut, unsigned int BlockSize);
int convertToDMG(AbstractFile* abstractIn, AbstractFile* abstractOut);
int convertToISO(AbstractFile* abstractIn, AbstractFile* abstractOut);
#ifdef __cplusplus
}
#endif
#endif

98
dump-imessages/iphone-dataprotection/emf_decrypter/includes/dmg/filevault.h Normal file
View File

@@ -0,0 +1,98 @@
#ifndef FILEVAULT_H
#define FILEVAULT_H
#include <stdint.h>
#include "dmg.h"
#ifdef HAVE_CRYPT
#include <openssl/hmac.h>
#include <openssl/aes.h>
#define FILEVAULT_CIPHER_KEY_LENGTH 16
#define FILEVAULT_CIPHER_BLOCKSIZE 16
#define FILEVAULT_CHUNK_SIZE 4096
#define FILEVAULT_PBKDF2_ITER_COUNT 1000
#define FILEVAULT_MSGDGST_LENGTH 20
/*
* Information about the FileVault format was yoinked from vfdecrypt, which was written by Ralf-Philipp Weinmann <ralf@coderpunks.org>,
* Jacob Appelbaum <jacob@appelbaum.net>, and Christian Fromme <kaner@strace.org>
*/
#define FILEVAULT_V2_SIGNATURE 0x656e637263647361ULL
typedef struct FileVaultV1Header {
uint8_t padding1[48];
uint32_t kdfIterationCount;
uint32_t kdfSaltLen;
uint8_t kdfSalt[48];
uint8_t unwrapIV[0x20];
uint32_t wrappedAESKeyLen;
uint8_t wrappedAESKey[296];
uint32_t wrappedHMACSHA1KeyLen;
uint8_t wrappedHMACSHA1Key[300];
uint32_t integrityKeyLen;
uint8_t integrityKey[48];
uint8_t padding2[484];
} __attribute__((__packed__)) FileVaultV1Header;
typedef struct FileVaultV2Header {
uint64_t signature;
uint32_t version;
uint32_t encIVSize;
uint32_t unk1;
uint32_t unk2;
uint32_t unk3;
uint32_t unk4;
uint32_t unk5;
UDIFID uuid;
uint32_t blockSize;
uint64_t dataSize;
uint64_t dataOffset;
uint8_t padding[0x260];
uint32_t kdfAlgorithm;
uint32_t kdfPRNGAlgorithm;
uint32_t kdfIterationCount;
uint32_t kdfSaltLen;
uint8_t kdfSalt[0x20];
uint32_t blobEncIVSize;
uint8_t blobEncIV[0x20];
uint32_t blobEncKeyBits;
uint32_t blobEncAlgorithm;
uint32_t blobEncPadding;
uint32_t blobEncMode;
uint32_t encryptedKeyblobSize;
uint8_t encryptedKeyblob[0x30];
} __attribute__((__packed__)) FileVaultV2Header;
typedef struct FileVaultInfo {
union {
FileVaultV1Header v1;
FileVaultV2Header v2;
} header;
uint8_t version;
uint64_t dataOffset;
uint64_t dataSize;
uint32_t blockSize;
AbstractFile* file;
HMAC_CTX hmacCTX;
AES_KEY aesKey;
AES_KEY aesEncKey;
off_t offset;
uint32_t curChunk;
unsigned char chunk[FILEVAULT_CHUNK_SIZE];
char dirty;
char headerDirty;
} FileVaultInfo;
#endif
AbstractFile* createAbstractFileFromFileVault(AbstractFile* file, const char* key);
#endif