01374c426e
Implementiert eigenen MobileBackup2-Restore-Trick zur Supervision-Übernahme von aktivierten iOS-Geräten ohne Factory-Reset. Foundation für DiGA-Phase-G Lock-Layer-Stack (non-removable Apps, non-removable Profiles, OnDemand-VPN- Toggle-Lock) auf Consumer-iPhones. Verifiziert end-to-end auf: - iPhone Air (iPhone18,4, iOS 26.5): TL→ReBreak re-supervise ✅ - Olfa iPhone 14 Pro (iPhone15,3, iOS 26.4.2): TL→ReBreak re-supervise ✅ Key empirische Findings: 1. Find-My-iPhone MUSS off sein (ErrorCode 211 sonst) → Stolen Device Protection (SDP) zwingt FMI an seit iOS 17.3+ 2. SupervisorHostCertificates DARF NICHT in CloudConfigurationDetails sein für fresh-supervise auf activated unsupervised devices (sonst partial-apply) 3. MCInstall.SetCloudConfiguration firet 14002 auf allen activated devices → MobileBackup2-Restore-Trick ist der einzige Weg 4. TL's extracted-embed-bytes != TL's wire-output (Runtime-Mutation) → Verbatim-Kopieren reicht nicht Reverse-Engineering basiert komplett auf: - Apple's public protocol docs (devicemanagement, mobilebackup2 schemas) - libimobiledevice (open-source reference impl) - TL public-distributed binary (interop-RE, legal per US-DMCA-1201 + EU-2009/24) Structure: cmd/supervise/ — main CLI (check, cloud-config, supervise, cert-info, unsupervise) cmd/dump-artifacts/ — diagnostic helper (no device needed) cmd/usbmux-proxy/ — MITM-proxy for TL-traffic-capture (debug) cmd/tl-patcher/ — patches TL's hard-coded usbmuxd path (debug) internal/dlmessage/ — DLMessage wire-protocol (4-byte BE length + plist) internal/mobilebackup2/— mobilebackup2-service impl (BaseVersionExchange, Hello, Restore, ServeFiles + TL-extracted templates) internal/cloudconfig/ — CloudConfigurationDetails.plist builder (cert-less, 25 keys matching TL's runtime-output) internal/cert/ — auto-gen + persist supervisor-cert in ~/.rebreak-supervise/ internal/mcinstall/ — MCInstall.GetCloudConfiguration für state-checks internal/device/ — go-ios DeviceEntry wrapper internal/afclock/ — AFC sync-lock auf /com.apple.itunes.lock_sync internal/notification_proxy/ — PostNotification (syncWillStart/etc) internal/preflight/ — FMI/Activation/OS-version pre-checks internal/supervise/ — End-to-end Flow-Orchestrierung (MobileBackup2 default, MCInstall via REBREAK_FORCE_MCINSTALL=1) Pending für volle Productization (Phase G): - Fresh-supervise direkt-empirisch auf truly-unsupervised iPhone testen (heute Nacht nur durch Inferenz aus TL-Verhalten gestützt) - Auto-MDM-enroll-Step nach Supervise (ConfigurationURL oder cfgutil-style) - DiGA-Onboarding-Flow + Lyra-Coach für FMI/SDP-Disable - Multi-Device-Validation (Modelle, iOS-Versionen) Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
106 lines
2.7 KiB
Go
106 lines
2.7 KiB
Go
// Package preflight prüft vor dem Supervise-Flow:
|
|
// - iPhone via USB erreichbar (über device.Connect)
|
|
// - ProductType iPhone/iPad (kein Mac, kein Apple-TV)
|
|
// - iOS-Version >= 16
|
|
// - ActivationState=Activated
|
|
// - Find-My-iPhone aus (via NonVolatileRAM-Parse)
|
|
// - IsSupervised-Status anzeigen (kein Hard-Fail bei true — caller entscheidet)
|
|
package preflight
|
|
|
|
import (
|
|
"fmt"
|
|
"strconv"
|
|
"strings"
|
|
|
|
"github.com/raynis/rebreak-supervise-magic/internal/device"
|
|
)
|
|
|
|
type Result struct {
|
|
OK bool
|
|
Reasons []string
|
|
Device DeviceInfo
|
|
}
|
|
|
|
type DeviceInfo struct {
|
|
UDID string
|
|
DeviceName string
|
|
ProductType string
|
|
ProductVersion string
|
|
ActivationState string
|
|
FindMyEnabled bool
|
|
IsSupervised bool
|
|
}
|
|
|
|
func Run(conn *device.Conn) (*Result, error) {
|
|
res := &Result{OK: true}
|
|
|
|
info, err := conn.Info()
|
|
if err != nil {
|
|
return nil, fmt.Errorf("preflight: device info: %w", err)
|
|
}
|
|
|
|
res.Device.UDID = conn.UDID()
|
|
res.Device.DeviceName = asString(info["DeviceName"])
|
|
res.Device.ProductType = asString(info["ProductType"])
|
|
res.Device.ProductVersion = asString(info["ProductVersion"])
|
|
res.Device.ActivationState = asString(info["ActivationState"])
|
|
|
|
if supervised, err := conn.IsSupervised(); err == nil {
|
|
res.Device.IsSupervised = supervised
|
|
}
|
|
if fmi, err := conn.FindMyEnabled(); err == nil {
|
|
res.Device.FindMyEnabled = fmi
|
|
}
|
|
|
|
if res.Device.FindMyEnabled {
|
|
res.OK = false
|
|
res.Reasons = append(res.Reasons,
|
|
"Find My iPhone is ON — disable in Settings → [Name] → Wo ist? → Mein iPhone suchen → AUS")
|
|
}
|
|
|
|
if !strings.HasPrefix(res.Device.ProductType, "iPhone") && !strings.HasPrefix(res.Device.ProductType, "iPad") {
|
|
res.OK = false
|
|
res.Reasons = append(res.Reasons,
|
|
fmt.Sprintf("ProductType '%s' not supported — only iPhone/iPad. Mac uses different stack (NanoMDM enrollment).", res.Device.ProductType))
|
|
}
|
|
|
|
if !checkIOSVersionAtLeast(res.Device.ProductVersion, 16) {
|
|
res.OK = false
|
|
res.Reasons = append(res.Reasons,
|
|
fmt.Sprintf("OS-Version '%s' too low. Need iOS 16+ for Cloud-Config-Plist-Path.", res.Device.ProductVersion))
|
|
}
|
|
|
|
if res.Device.ActivationState != "" && res.Device.ActivationState != "Activated" {
|
|
res.OK = false
|
|
res.Reasons = append(res.Reasons,
|
|
fmt.Sprintf("ActivationState '%s' — device must be activated.", res.Device.ActivationState))
|
|
}
|
|
|
|
if len(res.Reasons) > 0 {
|
|
res.OK = false
|
|
}
|
|
return res, nil
|
|
}
|
|
|
|
func asString(v any) string {
|
|
if s, ok := v.(string); ok {
|
|
return s
|
|
}
|
|
return ""
|
|
}
|
|
|
|
func checkIOSVersionAtLeast(version string, minMajor int) bool {
|
|
if version == "" {
|
|
return true
|
|
}
|
|
parts := strings.SplitN(version, ".", 2)
|
|
if len(parts) == 0 {
|
|
return true
|
|
}
|
|
major, err := strconv.Atoi(parts[0])
|
|
if err != nil {
|
|
return true
|
|
}
|
|
return major >= minMajor
|
|
}
|