Skip to content

Instantly share code, notes, and snippets.

@biemster
biemster / parse_nacsig.py
Last active May 11, 2025 16:00
Initial parsing of the validation blob for IDS registration which comes out of IMDAppleServices
#!/usr/bin/env python
import apple_auth
from io import BytesIO
vd = BytesIO(bytes(apple_auth.IDS(open('idevice.json').read()).request_validation_data())) # create json with Smoothstep/apple-gen-rs
tag = vd.read(1) # always 0x02, maybe like the APNS msg for cert?
stat16b = vd.read(16) # static across machines, some versioning?
dyn16b = vd.read(16) # the actual signature from the obfuscated algorithm
len_payload = vd.read(4)
payload = BytesIO(vd.read(int.from_bytes(len_payload,"big")))