chahinebrini
|
2cb1f8ad6e
|
feat(binder-mac): SwiftUI Wizard für Self-Bind End-to-End-Flow
apps/rebreak-binder-mac/ — neue macOS-App die User durch den kompletten
Self-Bind-Prozess führt: Welcome → Preflight → Supervise → Enroll →
Configure (MDM-Push + Pre/Post-Check) → Sideload Lock-Profile (AirDrop).
3-Layer Smart-Resume: supervised? + Enrollment-Profil installed (cfgutil
Ground-Truth)? + MDM-Ack fresh (NanoMDM-DB via ssh+psql)?
Services: DeviceDetector (ideviceinfo + cfgutil), SuperviseRunner
(spawnt supervise-magic CLI), MDMClient (PUT /v1/enqueue?push=1, Apple
XML-Plist, identisch zum server-watcher-Format), MDMStatus (DB-Real-
Check + ManagedApplicationList-Result-Read).
Plus:
- fix(supervise-magic): EOF nach ProcessMessage Response (ErrorCode=0)
ist Success, nicht Error — vermeidet false-fail bei iPhone-Restore-
Reboot
- feat(mdm-profiles): rebreak-content-filter-mdm.mobileconfig als
MDM-Push-Variante (ohne ConsentText, ohne globales allowAppRemoval=
false — per-app via managed-state)
End-to-End validiert: App-Push via Ad-Hoc-Manifest (silent), Managed-
State via ManagedApplicationList-Query, NEFilter-Mode nach App-Force-
Quit, Lock-Profile non-removable nach Sideload.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
|
2026-05-27 08:37:14 +02:00 |
|
chahinebrini
|
01374c426e
|
feat(supervise-magic): TechLockdown-clone v1 — supervise iPhones without erase
Implementiert eigenen MobileBackup2-Restore-Trick zur Supervision-Übernahme
von aktivierten iOS-Geräten ohne Factory-Reset. Foundation für DiGA-Phase-G
Lock-Layer-Stack (non-removable Apps, non-removable Profiles, OnDemand-VPN-
Toggle-Lock) auf Consumer-iPhones.
Verifiziert end-to-end auf:
- iPhone Air (iPhone18,4, iOS 26.5): TL→ReBreak re-supervise ✅
- Olfa iPhone 14 Pro (iPhone15,3, iOS 26.4.2): TL→ReBreak re-supervise ✅
Key empirische Findings:
1. Find-My-iPhone MUSS off sein (ErrorCode 211 sonst)
→ Stolen Device Protection (SDP) zwingt FMI an seit iOS 17.3+
2. SupervisorHostCertificates DARF NICHT in CloudConfigurationDetails sein
für fresh-supervise auf activated unsupervised devices (sonst partial-apply)
3. MCInstall.SetCloudConfiguration firet 14002 auf allen activated devices
→ MobileBackup2-Restore-Trick ist der einzige Weg
4. TL's extracted-embed-bytes != TL's wire-output (Runtime-Mutation)
→ Verbatim-Kopieren reicht nicht
Reverse-Engineering basiert komplett auf:
- Apple's public protocol docs (devicemanagement, mobilebackup2 schemas)
- libimobiledevice (open-source reference impl)
- TL public-distributed binary (interop-RE, legal per US-DMCA-1201 + EU-2009/24)
Structure:
cmd/supervise/ — main CLI (check, cloud-config, supervise, cert-info, unsupervise)
cmd/dump-artifacts/ — diagnostic helper (no device needed)
cmd/usbmux-proxy/ — MITM-proxy for TL-traffic-capture (debug)
cmd/tl-patcher/ — patches TL's hard-coded usbmuxd path (debug)
internal/dlmessage/ — DLMessage wire-protocol (4-byte BE length + plist)
internal/mobilebackup2/— mobilebackup2-service impl (BaseVersionExchange,
Hello, Restore, ServeFiles + TL-extracted templates)
internal/cloudconfig/ — CloudConfigurationDetails.plist builder (cert-less,
25 keys matching TL's runtime-output)
internal/cert/ — auto-gen + persist supervisor-cert in ~/.rebreak-supervise/
internal/mcinstall/ — MCInstall.GetCloudConfiguration für state-checks
internal/device/ — go-ios DeviceEntry wrapper
internal/afclock/ — AFC sync-lock auf /com.apple.itunes.lock_sync
internal/notification_proxy/ — PostNotification (syncWillStart/etc)
internal/preflight/ — FMI/Activation/OS-version pre-checks
internal/supervise/ — End-to-end Flow-Orchestrierung (MobileBackup2 default,
MCInstall via REBREAK_FORCE_MCINSTALL=1)
Pending für volle Productization (Phase G):
- Fresh-supervise direkt-empirisch auf truly-unsupervised iPhone testen
(heute Nacht nur durch Inferenz aus TL-Verhalten gestützt)
- Auto-MDM-enroll-Step nach Supervise (ConfigurationURL oder cfgutil-style)
- DiGA-Onboarding-Flow + Lyra-Coach für FMI/SDP-Disable
- Multi-Device-Validation (Modelle, iOS-Versionen)
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
|
2026-05-27 01:55:10 +02:00 |
|