chahinebrini 01374c426e feat(supervise-magic): TechLockdown-clone v1 — supervise iPhones without erase
Implementiert eigenen MobileBackup2-Restore-Trick zur Supervision-Übernahme
von aktivierten iOS-Geräten ohne Factory-Reset. Foundation für DiGA-Phase-G
Lock-Layer-Stack (non-removable Apps, non-removable Profiles, OnDemand-VPN-
Toggle-Lock) auf Consumer-iPhones.

Verifiziert end-to-end auf:
- iPhone Air (iPhone18,4, iOS 26.5): TL→ReBreak re-supervise 
- Olfa iPhone 14 Pro (iPhone15,3, iOS 26.4.2): TL→ReBreak re-supervise 

Key empirische Findings:
1. Find-My-iPhone MUSS off sein (ErrorCode 211 sonst)
   → Stolen Device Protection (SDP) zwingt FMI an seit iOS 17.3+
2. SupervisorHostCertificates DARF NICHT in CloudConfigurationDetails sein
   für fresh-supervise auf activated unsupervised devices (sonst partial-apply)
3. MCInstall.SetCloudConfiguration firet 14002 auf allen activated devices
   → MobileBackup2-Restore-Trick ist der einzige Weg
4. TL's extracted-embed-bytes != TL's wire-output (Runtime-Mutation)
   → Verbatim-Kopieren reicht nicht

Reverse-Engineering basiert komplett auf:
- Apple's public protocol docs (devicemanagement, mobilebackup2 schemas)
- libimobiledevice (open-source reference impl)
- TL public-distributed binary (interop-RE, legal per US-DMCA-1201 + EU-2009/24)

Structure:
  cmd/supervise/         — main CLI (check, cloud-config, supervise, cert-info, unsupervise)
  cmd/dump-artifacts/    — diagnostic helper (no device needed)
  cmd/usbmux-proxy/      — MITM-proxy for TL-traffic-capture (debug)
  cmd/tl-patcher/        — patches TL's hard-coded usbmuxd path (debug)
  internal/dlmessage/    — DLMessage wire-protocol (4-byte BE length + plist)
  internal/mobilebackup2/— mobilebackup2-service impl (BaseVersionExchange,
                          Hello, Restore, ServeFiles + TL-extracted templates)
  internal/cloudconfig/  — CloudConfigurationDetails.plist builder (cert-less,
                          25 keys matching TL's runtime-output)
  internal/cert/         — auto-gen + persist supervisor-cert in ~/.rebreak-supervise/
  internal/mcinstall/    — MCInstall.GetCloudConfiguration für state-checks
  internal/device/       — go-ios DeviceEntry wrapper
  internal/afclock/      — AFC sync-lock auf /com.apple.itunes.lock_sync
  internal/notification_proxy/ — PostNotification (syncWillStart/etc)
  internal/preflight/    — FMI/Activation/OS-version pre-checks
  internal/supervise/    — End-to-end Flow-Orchestrierung (MobileBackup2 default,
                          MCInstall via REBREAK_FORCE_MCINSTALL=1)

Pending für volle Productization (Phase G):
- Fresh-supervise direkt-empirisch auf truly-unsupervised iPhone testen
  (heute Nacht nur durch Inferenz aus TL-Verhalten gestützt)
- Auto-MDM-enroll-Step nach Supervise (ConfigurationURL oder cfgutil-style)
- DiGA-Onboarding-Flow + Lyra-Coach für FMI/SDP-Disable
- Multi-Device-Validation (Modelle, iOS-Versionen)

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-27 01:55:10 +02:00

86 lines
2.6 KiB
Go

// Package notification_proxy implementiert Apple's `com.apple.mobile.notification_proxy`
// für PostNotification-calls. Diese sind nötig vor mobilebackup2-Restore
// damit iOS den Restore als "legitimate iTunes-style sync" akzeptiert.
//
// Reverse-engineered aus TechLockdown's safesurfer.go calls — TL ruft
// postNotification VOR + NACH dem mobilebackup2-Restore-Block.
//
// Wire-Format: 4-byte BE length-prefix + XML plist (dict).
package notification_proxy
import (
"encoding/binary"
"fmt"
ios "github.com/danielpaulus/go-ios/ios"
)
const serviceName = "com.apple.mobile.notification_proxy"
// Apple's standard sync notifications die iOS während iTunes-style sync erwartet.
const (
SyncWillStart = "com.apple.itunes-mobdev.syncWillStart"
SyncDidStart = "com.apple.itunes-mobdev.syncDidStart"
SyncLockRequest = "com.apple.itunes-mobdev.syncLockRequest"
SyncDidFinish = "com.apple.itunes-mobdev.syncDidFinish"
BackupDomainChanged = "com.apple.mobile.backup.domain_changed"
)
type Client struct {
conn ios.DeviceConnectionInterface
codec ios.PlistCodec
}
// Open startet die notification-proxy session via Lockdown.
func Open(device ios.DeviceEntry) (*Client, error) {
conn, err := ios.ConnectToService(device, serviceName)
if err != nil {
return nil, fmt.Errorf("notification_proxy: connect: %w", err)
}
return &Client{
conn: conn,
codec: ios.NewPlistCodec(),
}, nil
}
func (c *Client) Close() error {
if c.conn != nil {
return c.conn.Close()
}
return nil
}
// PostOnce — convenience: open NP, send PostNotification, close. Vermeidet
// connection-sharing-issues mit anderen Services über usbmuxd-socket.
func PostOnce(device ios.DeviceEntry, name string) error {
c, err := Open(device)
if err != nil {
return err
}
defer c.Close()
return c.PostNotification(name)
}
// PostNotification triggert eine system-weite Notification auf iOS.
// iOS-Subsystems die diese Notification subscribed haben werden geweckt.
func (c *Client) PostNotification(name string) error {
msg := map[string]interface{}{
"Command": "PostNotification",
"Name": name,
}
encoded, err := c.codec.Encode(msg)
if err != nil {
return fmt.Errorf("notification_proxy: encode: %w", err)
}
// Apple's NP-service erwartet 4-byte BE length-prefix + plist-bytes
hdr := make([]byte, 4)
binary.BigEndian.PutUint32(hdr, uint32(len(encoded)))
if err := c.conn.Send(hdr); err != nil {
return fmt.Errorf("notification_proxy: send header: %w", err)
}
if err := c.conn.Send(encoded); err != nil {
return fmt.Errorf("notification_proxy: send payload: %w", err)
}
return nil
}