feat(supervise-magic): TechLockdown-clone v1 — supervise iPhones without erase
Implementiert eigenen MobileBackup2-Restore-Trick zur Supervision-Übernahme
von aktivierten iOS-Geräten ohne Factory-Reset. Foundation für DiGA-Phase-G
Lock-Layer-Stack (non-removable Apps, non-removable Profiles, OnDemand-VPN-
Toggle-Lock) auf Consumer-iPhones.
Verifiziert end-to-end auf:
- iPhone Air (iPhone18,4, iOS 26.5): TL→ReBreak re-supervise ✅
- Olfa iPhone 14 Pro (iPhone15,3, iOS 26.4.2): TL→ReBreak re-supervise ✅
Key empirische Findings:
1. Find-My-iPhone MUSS off sein (ErrorCode 211 sonst)
→ Stolen Device Protection (SDP) zwingt FMI an seit iOS 17.3+
2. SupervisorHostCertificates DARF NICHT in CloudConfigurationDetails sein
für fresh-supervise auf activated unsupervised devices (sonst partial-apply)
3. MCInstall.SetCloudConfiguration firet 14002 auf allen activated devices
→ MobileBackup2-Restore-Trick ist der einzige Weg
4. TL's extracted-embed-bytes != TL's wire-output (Runtime-Mutation)
→ Verbatim-Kopieren reicht nicht
Reverse-Engineering basiert komplett auf:
- Apple's public protocol docs (devicemanagement, mobilebackup2 schemas)
- libimobiledevice (open-source reference impl)
- TL public-distributed binary (interop-RE, legal per US-DMCA-1201 + EU-2009/24)
Structure:
cmd/supervise/ — main CLI (check, cloud-config, supervise, cert-info, unsupervise)
cmd/dump-artifacts/ — diagnostic helper (no device needed)
cmd/usbmux-proxy/ — MITM-proxy for TL-traffic-capture (debug)
cmd/tl-patcher/ — patches TL's hard-coded usbmuxd path (debug)
internal/dlmessage/ — DLMessage wire-protocol (4-byte BE length + plist)
internal/mobilebackup2/— mobilebackup2-service impl (BaseVersionExchange,
Hello, Restore, ServeFiles + TL-extracted templates)
internal/cloudconfig/ — CloudConfigurationDetails.plist builder (cert-less,
25 keys matching TL's runtime-output)
internal/cert/ — auto-gen + persist supervisor-cert in ~/.rebreak-supervise/
internal/mcinstall/ — MCInstall.GetCloudConfiguration für state-checks
internal/device/ — go-ios DeviceEntry wrapper
internal/afclock/ — AFC sync-lock auf /com.apple.itunes.lock_sync
internal/notification_proxy/ — PostNotification (syncWillStart/etc)
internal/preflight/ — FMI/Activation/OS-version pre-checks
internal/supervise/ — End-to-end Flow-Orchestrierung (MobileBackup2 default,
MCInstall via REBREAK_FORCE_MCINSTALL=1)
Pending für volle Productization (Phase G):
- Fresh-supervise direkt-empirisch auf truly-unsupervised iPhone testen
(heute Nacht nur durch Inferenz aus TL-Verhalten gestützt)
- Auto-MDM-enroll-Step nach Supervise (ConfigurationURL oder cfgutil-style)
- DiGA-Onboarding-Flow + Lyra-Coach für FMI/SDP-Disable
- Multi-Device-Validation (Modelle, iOS-Versionen)
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
01374c426e