JJTech0130

// To compile: clang++ -arch x86_64 -arch arm64 -arch arm64e -std=c++20 library_injector.cpp -lbsm -lEndpointSecurity -o library_injector,
// then codesign with com.apple.developer.endpoint-security.client and run the
// program as root.

#include <EndpointSecurity/EndpointSecurity.h>
#include <algorithm>
#include <array>
#include <bsm/libbsm.h>
#include <cstddef>
#include <cstdint>

JJTech0130

"""
Ford ECU SecurityAccess seed-key algorithms, reversed from libfnvfsa.so on the ECG2 GWM

Algorithm 0: legacy 24-bit Galois LFSR cipher (3-byte seed, 5-byte/40-bit secret)
Described in https://flaviodgarcia.com/publications/BtB.pdf

Algorithms 1/2: modern HMAC-SHA1 (16-byte seed, 12-byte fixedBytes)

TODO: Test against a real vehicle
"""

JJTech0130

// Dumps the 8 SYNCP AES-128 keys + ESN from the DPS partition on SYNC 3

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <fcntl.h>
#include <unistd.h>
#include <errno.h>

#define EMMC_DEVICE "/dev/hd0"

JJTech0130

# Implements very basic test of the iAP2 protocol over "com.apple.carkit.service", the lockdownd service used by CarPlay Simulator
import asyncio
from pymobiledevice3.lockdown import create_using_usbmux
 
def checksum(data):
    return (0x100 - sum(data)) & 0xFF
 
def build_packet(control, seq, ack, session_id=0, payload=b''):
    length = 9 + (len(payload) + 1 if payload else 0)
    header = bytes([0xFF, 0x5A, length >> 8, length & 0xFF, control, seq, ack, session_id])

JJTech0130

-- Wireshark Lua dissector for Lutron Clear Connect - Type X (CCX)
-- UDP/9190 over a Thread/802.15.4 mesh

local cbor = require("simple_cbor")

local ccx_proto = Proto("clearconnectx", "Lutron Clear Connect - Type X")

local f_msg_id = ProtoField.uint32("clearconnectx.msg_id", "Message ID", base.DEC)
local f_note   = ProtoField.string("clearconnectx.note", "Note")
ccx_proto.fields = { f_msg_id, f_note }

JJTech0130

Model	BoardConfig	Processor	Chipset	Module	Fillmore[^1]
Mac Pro (2023)	J180dAP	M2 Ultra	4388	sumatra	no
Mac mini (M1, 2020)	J274AP	M1	4378	atlantisb	no
MacBook Pro (13-inch, M1, 2020)	J293AP	M1	4378	honshu	no
MacBook Air (M1, 2020)	J313AP	M1	4378	shikoku	no
MacBook Pro (14-inch, 2021)	J314cAP	M1 Max	4387	maldives	no
MacBook Pro (14-inch, 2021)	J314sAP	M1 Pro	4387	maldives	no
MacBook Pro (16-inch, 2021)	J316cAP	M1 Max	4387	madagascar	no
MacBook Pro (16-inch, 2021)	J316sAP	M1 Pro	4387	madagascar	no

JJTech0130

device-tree:
  AAPL,phandle: 1
  config-number: "syscfg/CFG#/0x40,zeroes/0x40"
  target-type: "J700"
  region-info: "syscfg/Regn/0x20,zeroes/0x20"
  time-stamp: "Mon Jun 1 21:23:12 PDT 2026"
    chosen:
      dram-vendor: 0
      marketing-software-behavior: "syscfg/MkBS"
      display-scale: 0

JJTech0130

-- iAP2 (iPod Accessory Protocol 2) 
--
-- Layers:
--   1. iAP2 Link — packet framing, control flags, checksums
--   2. iAP2 Session — payload interpretation based on session type
--      a. Control Session messages with parameters
--      b. File Transfer Session datagrams
--      c. External Accessory Session datagrams

-- ============================================================

JJTech0130

// This script implements SSL keylogging for libssl.35.dylib, which is an old version of LibreSSL.
// Primarily intended to be used when debugging MobileDevice.framework, which uses it for some reason.

var mod = Process.getModuleByName("libssl.35.dylib");
var gen_master = mod.findExportByName("tls1_generate_master_secret");

var keylogPath = '/tmp/keylog.txt';
var keylog = new File(keylogPath, "a");

var toHex = function(arr) {

JJTech0130

local proto_usbmuxd = Proto("usbmuxd",  "Usbmuxd Protocol")

proto_usbmuxd.fields.protocol = ProtoField.uint32("usbmuxd.protocol", "Message Kind", base.DEC)
proto_usbmuxd.fields.length = ProtoField.uint32("usbmuxd.length", "Length", base.DEC)
proto_usbmuxd.fields.magic = ProtoField.uint32("usbmuxd.magic", "Magic", base.HEX)
proto_usbmuxd.fields.tx_seq = ProtoField.uint16("usbmuxd.tx_seq", "Transmit sequence", base.DEC)
proto_usbmuxd.fields.rx_seq = ProtoField.uint16("usbmuxd.rx_seq", "Receive sequence", base.DEC)

proto_usbmuxd.fields.version_major = ProtoField.uint32("usbmuxd.version_major", "Major version", base.DEC)
proto_usbmuxd.fields.version_minor = ProtoField.uint32("usbmuxd.version_minor", "Minor version", base.DEC)