iOS9

So i've managed to get iOS9 to negotiate and start sending data. The config record looks correct (non encrypted). But the video data makes no sense once decrypted.

It appears that the key must have changed.

I tried to find a decrypted version of the newest formware for apple TV but I can't seem to find one. Emulating thumb is not a problem if i can find the firmware.

Any ideas

[espes]

what happened?

I just updated the first post.

It works, the problem was I wasn't keeping the event port open. But the decryption key seems incorrect.

As a sanity check I checked the challenge/response from a log of ios9 and an appleTV and fed the same into the existing airtunesd and the results are different. ios9 still seems to accept them and sends the video data though.

I can only guess the decryption key must have changed.

There also seems to be data of type 5 every 30 video packets. I'm guessing it may be audio info since everything is now being sent over this one connection.

Type is: 1
config record
Type is: 0
Encrypted Video Data
Type is: 0
Encrypted Video Data
Type is: 0
Encrypted Video Data
Type is: 0
Encrypted Video Data
Type is: 0
Encrypted Video Data
Type is: 0
Encrypted Video Data
Type is: 0
Encrypted Video Data
Type is: 0
Encrypted Video Data
Type is: 0
Encrypted Video Data
Type is: 0
Encrypted Video Data
Type is: 0
Encrypted Video Data
Type is: 0
Encrypted Video Data
Type is: 0
Encrypted Video Data
Type is: 0
Encrypted Video Data
Type is: 0
Encrypted Video Data
Type is: 0
Encrypted Video Data
Type is: 0
Encrypted Video Data
Type is: 0
Encrypted Video Data
Type is: 0
Encrypted Video Data
Type is: 0
Encrypted Video Data
Type is: 0
Encrypted Video Data
Type is: 0
Encrypted Video Data
Type is: 0
Encrypted Video Data
Type is: 0
Encrypted Video Data
Type is: 0
Encrypted Video Data
Type is: 0
Encrypted Video Data
Type is: 0
Encrypted Video Data
Type is: 0
Encrypted Video Data
Type is: 0
Encrypted Video Data
Type is: 0
Encrypted Video Data
Type is: 0
Encrypted Video Data
Type is: 0
Encrypted Video Data
Type is: 0
Encrypted Video Data
Type is: 0
Encrypted Video Data
Type is: 0
Encrypted Video Data
Type is: 0
Encrypted Video Data
Type is: 5
wtf 194 5 0 0.0
Type is: 0
Encrypted Video Data
Type is: 0
Encrypted Video Data
Type is: 0
Encrypted Video Data
Type is: 0
Encrypted Video Data
Type is: 0
Encrypted Video Data
Type is: 0
Encrypted Video Data
Type is: 0
Encrypted Video Data
Type is: 0
Encrypted Video Data
Type is: 0
Encrypted Video Data
Type is: 0
Encrypted Video Data
Type is: 0
Encrypted Video Data
Type is: 0
Encrypted Video Data
Type is: 0
Encrypted Video Data
Type is: 0
Encrypted Video Data
Type is: 0
Encrypted Video Data
Type is: 0
Encrypted Video Data
Type is: 0
Encrypted Video Data
Type is: 0
Encrypted Video Data
Type is: 0
Encrypted Video Data
Type is: 0
Encrypted Video Data
Type is: 0
Encrypted Video Data
Type is: 0
Encrypted Video Data
Type is: 0
Encrypted Video Data
Type is: 0
Encrypted Video Data
Type is: 0
Encrypted Video Data
Type is: 0
Encrypted Video Data
Type is: 0
Encrypted Video Data
Type is: 0
Encrypted Video Data
Type is: 0
Encrypted Video Data
Type is: 5
wtf 25194 5 0 0.0

Strangely ios7 works with the same protocol, AND the video data still doesn't decrypt.

Hmm looks like i've hit a dead :( It seems ios9 is using a different key/encryption which probably needs the library from the new apple tv firmware. I don't think decryption keys are available for the new apple tv firmware tho?

Any ideas on your end? It's also possible the video format has changed but i doubt it.

Maybe the sochi firmware can handle this type of encryption. I'll have to setup qemu and find the entry points tho. Any chance you have the entry points already?

[espes]

No. I'm going to have a look at all this soon now that unicorn is released.

Oh i didn't know about unicorn! I'm attempting to decrypt an even newer firmware at the moment, will let you know how it goes. In the meantime here's a quick test vector for challenge 1 so you can check if it's generating with the new or old key.

46504c590301010000000004020003bb
< 46504c5903010200000000820203d7ce93237c7d52efb40385eee64ed14616cad9dc49bdba930c1d8b359475f8d3da5a8356dbdd929eddb74e3a5e2b1e3c7e2587b9ba5a48f387484a4530f825d789440f15f9965d547d2bb51d45f1de0c58962bcbc0b8ca451793305a89aafbd60bf436272dd75fff777b2976112f8b373bac39e8175ac4a5b08e2f95cab6e47e

The current airtunesd returns this instead:
46504c5903010200000000820203879f7a3d3ce5a4c5db51176fa886babd9ca307a9626d8bbeee2ec31a2efdec3d9f5714833e2b3ffe6044b09a8c9946dfda0bceb86af01d27757f2f37ab366d138c0bd89b792d35695884089618460d4888ee0d09ed829b61a94f41e0f4cba1d49a2009130a64336ce44a030bca9960b9ba91511db91f4a3df46f246de2171f98

[Noiled]

@Kam187 which firmware do you use to pass negotiate?

It's a special set of attributes in the bonjour message to skip it. Let me get to my computer and I'll post it in about half an hour.

Here you go:
The real device sends 0x507FFFF7,0x1E but the following is sufficient to make the device connect AND skip the initial verify stages:

            'features': u'0x507FFFF7',
            'model' : u'AppleTV3,2',
            'srcvers': u'220.68',

[Noiled]

@Kam187 when I change the attributes as you said above , no video data comes and logs below
AirTunes: 172.16.8.93 - - [22/Oct/2015 16:11:39] "POST /fp-setup HTTP/1.1" 200 -
AirTunes: 172.16.8.93 - - [22/Oct/2015 16:11:39] code 501, message Unsupported method ('TEARDOWN')

on iOS 9.0.2