From 69e93b2785bd065aca884068d8e1bca2c0465001 Mon Sep 17 00:00:00 2001
From: Kenneth Endfinger <kaendfinger@gmail.com>
Date: Sun, 13 Oct 2019 05:12:26 -0500
Subject: [PATCH] Sigh, Apple's signature algorithm is intentionally
 complicated.

---
 registration/cert.cer       | Bin 0 -> 2385 bytes
 registration/register.dart  |  52 ++++++++++++++++++++++++++++++++++++
 registration/unregister.bin | Bin 0 -> 661 bytes
 signature/README.md         |  14 ++++++++++
 4 files changed, 66 insertions(+)
 create mode 100644 registration/cert.cer
 create mode 100644 registration/register.dart
 create mode 100644 registration/unregister.bin

diff --git a/registration/cert.cer b/registration/cert.cer
new file mode 100644
index 0000000000000000000000000000000000000000..b1669e69e2299121ee0c5a26dc3c90e06fe02558
GIT binary patch
literal 2385
zcmd6odsq`!8pboZNkRY>1a%Xc287BbISDLyLkLhYMFC+$SzOVOM2V0DlR*p>Gyy`F
zQY>N%3X~L9p~~Hsi=_%t7ErE&yHcJmNLhqM5w#Tr3OfPo%071ecmK#U=R5PAIq#gj
z^LrsI27@;TYW!-T#?EMQSO|-SsKAIwveWF+Oc_BCfq((wEJHvd;&^zXDV7(+G6k#j
z1=*C$iH?pE!Ca|;!Lk9?`bk4m+R~(#NREgPi3NN_ER({V7$ia_7b8lRIWW`r;Y^K|
z`T}J#1oq;94HiZ$7GSYmSX%(g$vG4)(ZQ<{sFL3-g7PL2l(&f30$dkGP{5LiAf*Bk
zNzfNTM2F=|ihn~tP($?Bj|U=PaB9c|gU*w&Y6!x7KWLJjbvtB}#?G+zi*=!_8;-_D
z90H*U8g5q25w{1}xWv^^WX4-?wY_VD3k|Ba-<Wmb4FA35@IkhrA3Hu}>X-JQiuG6L
zETdZATT!as{H*xIO+Q^_aNmw9i3HDC-+11qp=8Yo$Kx57R}_dU;}U<!_Ko$pHxV%2
z92sIj%=&;AZ#zvM`DV?7qRbahPK|gf-OYR0d8>|bHj!DR$0qxxpA~&I6=?MBv?Ee-
zk!xw$@gboo+3i|qLD40v<U{jK=BpF-4Y6V~u%v;6gyGb|hnx}%2mD~Y@-Kfr?oIr7
zo3FM$X{bW|4f`6NihHEq5#wss8I!MONjgbpnr>Sx4#Gf%sxqLu42;o3rkOy{0v?Y#
zO9M>wwW+=)033P&H2s7z-W+c>2^4~-k7*@sBP4d?j54lL91sC4^|!6?Yk~PGGy5*F
z&)H+7`JW;`VR&4e^4W9JAPl(Z8!Yim;0Wxso3yr?jS&bEy_Ly~jg4jS_2y&<WD@4$
zNWf>xQLixs@+h#9NM7`}KuE;m@mSR2%N>vYr4YvL!_%df6nbioZ(--OeT8Mjeacj>
zb)q@Wv8SrI%WJfJdzMX0>0O7LyLmwnw`=I@*^z#EclNh)IW2xQr`trDliqdT+uHdJ
z+#cwOAK)CFzS2M|AUoAPv~N<#XYb$IpU!mtDe|VjNlR*p$*gRnw5BY*c^F#@`|S_j
z&CRN`MiN>xGo91Ubr&^IdwO+c;_>|a4~8O|Z{2O8tA(79`QzQU8eg~^iS(YjqLIf5
zJuFyx^(8TrGfsQ|`5km5#C;M|cJ5DPUF%pFH3j=nYrx~!<)jId(*tnrgR9Cr<m<)*
zpOv2}&19U-`&;=!gUyqFoIOMBt9Ns0<IQaD$6yF7pe8t?bXc=Q1_NJ*j9s*xc<p~3
z*Z<AOxdag>_U{3U<>bWHL&O<4v7KL*K+K|n-=Utt<0xj{fqURThy)Q*S(NOsSfqeC
zXxFb4dmBK0Mc^{}ybj5?a^h>EBtfLex__NpIdh)QDC#+?f+M+{HM;(TaepnS*%QZ1
zZxpPc;@dLs4H~u7KHb+Lnen{6(nDuWE*hrUs8e?U&HhIgn<r8(e>b}8eQs<rqb4IM
zXHz_fpjG}{n$~D|FHig+x9Y2%UB2_AwE@<tfAq1Z^L!rdrRRB$<xQw=__Pnp$ae1j
z_IL1IwP~Zm?17GhK{+3-@9fnXA)@Qgl2Z=&rmQSTNtNvI;2FQjKi9_2Ox*iXYu$8M
z>$(FL4<d6;Z2e&&VxYI%nTI@_@*Smq8k78V&THX<w^g9~?9cD~m}u^Pjf}k5j+{F(
z?|vur%YYvlAMY}v+ibi01$T)PYUnC@Qq`}4;EuJ`?D%N<>7%(x6X6QCu`p{A6HxTu
z`64*50J97WZ{&s=S|ksQS3?B!@eokWzYH{ikbqW`;9a7DJrT{e6<Ele`oEX~R5xC=
zVu7lfqPh|&iW2js0uhYn8WJH^z=Bs%CxXM3Fkh;Kqxo_K9Vrws64Y6Ifj|_EEUh_&
zt`X^fQdo~AG$6y#2vwkWg?zaXMnrN6x<D#~1v05ntPf8GEIS0pC`1m+Hj0*^YxSF<
zov-%SM{Ts6FF?eoJoK4psEMSAf&rLIpnMmg2G`QHux7){mquy$Iw%#Wo<%|~LpMPS
zO#een3Zy6aZ$L9%StO8hwq0xNs7#xY0J!!l7o2gU@jB{sj=tedw>+NL)K@;gb8)5=
ziu9+pm38cd7j#z|9Af>uOucufH1i!zn%le>u3KGyDa$^;x|&;YDYhp__4%pxq<+OE
zpJF)JMb~#>jIy0hQ$BuB;ZKSWo2{Z3R!>=NBqb_~or9A`-YcblN#*4hFfFU!sav>b
z(yAaGo5WeHJ3Ur7H{yBwfKc;!T7<h!8{*lUe@yb(^@gc_Gh{BbSlxVaE;!Y-rbV7x
zpX1%VbLbQ6zLU1fCrDjWRfX=p4RLs({DNU$;fBxpy))Xze6eiYNZ|7#yHG3VE}F&D
L@qg)*<gtGPTlaa%

literal 0
HcmV?d00001

diff --git a/registration/register.dart b/registration/register.dart
new file mode 100644
index 0000000..627d06f
--- /dev/null
+++ b/registration/register.dart
@@ -0,0 +1,52 @@
+import 'dart:async';
+import 'dart:convert';
+import 'dart:io';
+
+Future<void> main(List<String> args) async {
+  var client = new HttpClient();
+  var request = await client
+      .postUrl(Uri.parse("https://lcdn-registration.apple.com/lcdn/register"));
+  request.write(json.encode({
+    "push-token": "fbFqxPukE8hfZD+Lbeo+E6390ih2lmY0I13apvLhZ6I=",
+    "ranked-peers": true,
+    "details": {
+      "capabilities": {
+        "ur": true,
+        "sc": true,
+        "pc": true,
+        "im": true,
+        "ns": true,
+        "query-parameters": true
+      },
+      "cache-size": 230000000000,
+      "ac-power": true,
+      "is-portable": true,
+      "local-network": [
+        {"speed": 1300, "wired": false}
+      ]
+    },
+    "local-ranges-only": true,
+    "local-ranges": [
+      {"first": "10.0.0.0", "last": "10.0.255.255"}
+    ],
+    "cache-software": [
+      {"type": "cache", "name": "Caching Server", "version": "233"},
+      {
+        "build": "19A583",
+        "type": "system",
+        "name": "Mac OS X",
+        "version": "10.15"
+      }
+    ],
+    "guid": "A14862D9-9643-4F18-B0BA-990BC2CAC0C2",
+    "local-addresses": [
+      {"address": "10.0.0.20", "netmask": "255.255.0.0", "port": "51391"}
+    ],
+    "session-token":
+        "1570938452471~46E0EE91164ABF1E4D42F7C3DC51B0747AD1BC3E7C9073CB6230D8F2191C40D9"
+  }));
+  var response = await request.close();
+  var result = await utf8.decodeStream(response);
+  print(result);
+  client.close();
+}
diff --git a/registration/unregister.bin b/registration/unregister.bin
new file mode 100644
index 0000000000000000000000000000000000000000..d3c85cb81e9362ac244ab45e8a9e697f40c9a4ab
GIT binary patch
literal 661
zcmV;G0&4vN=Q&mzR=Tb%t<1>plKQ!gqXi%37`YV0G=}2mm8sZI0007T1poj50RR92
zfFV$jQOGQw3HXV+7tP!Ay?dw28QAf~@xcy0tysyOE1?ajXDZSfLXij%TNAnV8$+z7
z-33W`RDb;H)7Uw~KZA5h0O{6hJ2gJTokGyRHe&3_d|lClClqFmk`}gIw~4Drt5+QN
ze~iIY--HRPW#;BJmI+8=kjvMr>wtVeG0wQP_=Tp8`n6y9{>|1LgP3uq_g)FafpnhU
z{DrZlNM`F=-HPdi9`bwc1bvLArY;-OsjElB*}0TKzT@~xr)8c;fV(wEjskfvV`A7-
zzHA7IB|2otMJ+-qttX_83bc$v^T_*5qJ=Jp6MvH9LoT^YcVbZM=6naI&$a6gB5+GN
zd}Yn7OJVv$WD#x8X2aor10Ev4?YFOHSXY@3^57kf%NH6R<lBLxFLAE*?VBx|)uUbR
z(|K-I<dU08U}YJ$VC9Nh4L39IxN9YTaN^FryBD7i-nkpT)atg5V^Ep9>qrel;%XZI
zRCW~O4H&q1_K@*t?5{Z#X24kHPyhe`kb5F$b!lWGIwC<aG&nXgL^&-vHZ(IWG)6Hv
zEkZCtK`l8sFhWBzLqS6@Loy;PB6DSPb7^mGEp%^dWo{xmA~7{LFgY_gG&M3fF*klR
zFhNE|MMgPBH$gWsL^DG}GdDv<MK>@-H8VLzGB-prG&DFvMKd@=HbyW-L^n1uMMN|>
zHA6u%Hbpi<L^3%deE<LePXWH3N~lU@?7hQjC8jCX)h?ieWvBoE05$~$4b3qCb%iO7
vb7rms+&Bm%U80^g*||Sxh*GKEPmwW$S2B0gO~YBiZ;<$5rqXc3%;3%M8mA*6

literal 0
HcmV?d00001

diff --git a/signature/README.md b/signature/README.md
index 3a146af..f005b02 100644
--- a/signature/README.md
+++ b/signature/README.md
@@ -11,3 +11,17 @@ The payload is in between these two parts.
 A 32-bit big endian unsigned number represents the payload size, and directly following the payload is a 32-bit big endian unsigned number representing the remaining bytes in the signature (however do note that there seem to be two trailing null characters).
 
 The first section contains what seems to be a header, then a length for some signature data at position 0x4A.
+
+Update: After a lot of work, I found the signature algorithm, and have been attempting to figure out it's origin. Turns out it's a custom algorithm just for Content Caching.
+
+I've got a few options here:
+
+1. Isolate the disassembled signature algorithm, and attempt to convert it to usable assembly. (Tough due to the use of a switch table...)
+2. Create a binary patcher which goes into the signature algorithm as an entry-point, then require any external server to call this binary over an RPC.
+3. Develop a Frida script to spawn the AssetCache server and hijack the registration data then kill the server.
+
+I prefer Option 1, but it's going to be a huge pain. Might need to contact others for assistance in cracking the algorithm, it's really just a bunch of magic numbers.
+
+I think I will start with a hybrid of Option 2 and Option 3, where I will make a server that does the registration for me by hijacking the AssetCache binary.
+
+Good news is, after registration is at least possible, the rest is super easy!