JJTech0130

Product	Model	BoardConfig	Chipset	Baseband
iPhone 6s	iPhone8,1	N71mAP	mav13
iPhone 6s	iPhone8,1	N71AP	mav13
iPhone 6s Plus	iPhone8,2	N66AP	mav13
iPhone 6s Plus	iPhone8,2	N66mAP	mav13
iPhone SE (1st generation)	iPhone8,4	N69AP	mav10
iPhone SE (1st generation)	iPhone8,4	N69uAP	mav10
iPhone 7	iPhone9,1	D10AP	mav16
iPhone 7 Plus	iPhone9,2	D11AP	mav16

JJTech0130

// To compile: clang++ -arch x86_64 -arch arm64 -arch arm64e -std=c++20 library_injector.cpp -lbsm -lEndpointSecurity -o library_injector,
// then codesign with com.apple.developer.endpoint-security.client and run the
// program as root.

#include <EndpointSecurity/EndpointSecurity.h>
#include <algorithm>
#include <array>
#include <bsm/libbsm.h>
#include <cstddef>
#include <cstdint>

JJTech0130

"""
Ford ECU SecurityAccess seed-key algorithms, reversed from libfnvfsa.so on the ECG2 GWM

Algorithm 0: legacy 24-bit Galois LFSR cipher (3-byte seed, 5-byte/40-bit secret)
Described in https://flaviodgarcia.com/publications/BtB.pdf

Algorithms 1/2: modern HMAC-SHA1 (16-byte seed, 12-byte fixedBytes)

TODO: Test against a real vehicle
"""

JJTech0130

// Dumps the 8 SYNCP AES-128 keys + ESN from the DPS partition on SYNC 3

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <fcntl.h>
#include <unistd.h>
#include <errno.h>

#define EMMC_DEVICE "/dev/hd0"

JJTech0130

# Implements very basic test of the iAP2 protocol over "com.apple.carkit.service", the lockdownd service used by CarPlay Simulator
import asyncio
from pymobiledevice3.lockdown import create_using_usbmux
 
def checksum(data):
    return (0x100 - sum(data)) & 0xFF
 
def build_packet(control, seq, ack, session_id=0, payload=b''):
    length = 9 + (len(payload) + 1 if payload else 0)
    header = bytes([0xFF, 0x5A, length >> 8, length & 0xFF, control, seq, ack, session_id])

JJTech0130

-- Wireshark Lua dissector for Lutron Clear Connect - Type X (CCX)
-- UDP/9190 over a Thread/802.15.4 mesh

local cbor = require("simple_cbor")

local ccx_proto = Proto("clearconnectx", "Lutron Clear Connect - Type X")

local f_msg_id = ProtoField.uint32("clearconnectx.msg_id", "Message ID", base.DEC)
local f_note   = ProtoField.string("clearconnectx.note", "Note")
ccx_proto.fields = { f_msg_id, f_note }

JJTech0130

Model	BoardConfig	Processor	Chipset	Module	Fillmore[^1]
Mac Pro (2023)	J180dAP	M2 Ultra	4388	sumatra	no
Mac mini (M1, 2020)	J274AP	M1	4378	atlantisb	no
MacBook Pro (13-inch, M1, 2020)	J293AP	M1	4378	honshu	no
MacBook Air (M1, 2020)	J313AP	M1	4378	shikoku	no
MacBook Pro (14-inch, 2021)	J314cAP	M1 Max	4387	maldives	no
MacBook Pro (14-inch, 2021)	J314sAP	M1 Pro	4387	maldives	no
MacBook Pro (16-inch, 2021)	J316cAP	M1 Max	4387	madagascar	no
MacBook Pro (16-inch, 2021)	J316sAP	M1 Pro	4387	madagascar	no

JJTech0130

device-tree:
  AAPL,phandle: 1
  config-number: "syscfg/CFG#/0x40,zeroes/0x40"
  target-type: "J700"
  region-info: "syscfg/Regn/0x20,zeroes/0x20"
  time-stamp: "Mon Jun 1 21:23:12 PDT 2026"
    chosen:
      dram-vendor: 0
      marketing-software-behavior: "syscfg/MkBS"
      display-scale: 0

JJTech0130

-- iAP2 (iPod Accessory Protocol 2) 
--
-- Layers:
--   1. iAP2 Link — packet framing, control flags, checksums
--   2. iAP2 Session — payload interpretation based on session type
--      a. Control Session messages with parameters
--      b. File Transfer Session datagrams
--      c. External Accessory Session datagrams

-- ============================================================

JJTech0130

// This script implements SSL keylogging for libssl.35.dylib, which is an old version of LibreSSL.
// Primarily intended to be used when debugging MobileDevice.framework, which uses it for some reason.

var mod = Process.getModuleByName("libssl.35.dylib");
var gen_master = mod.findExportByName("tls1_generate_master_secret");

var keylogPath = '/tmp/keylog.txt';
var keylog = new File(keylogPath, "a");

var toHex = function(arr) {