seemoo-lab / aristoteles Goto Github PK

A Wireshark dissector for the Apple Remote Invocation (ARI) protocol, used between Intel base band chips and the iOS CommCenter for various management purposes, SMS, telephony and much more.

License: MIT License

Lua 93.50% Python 5.73% Shell 0.07% JavaScript 0.70%

wireshark dissector apple frida ghidra wireshark-dissector

aristoteles's Introduction

Welcome to GitHub Pages

You can use the editor on GitHub to maintain and preview the content for your website in Markdown files.

Whenever you commit to this repository, GitHub Pages will run Jekyll to rebuild the pages in your site, from the content in your Markdown files.

Markdown

Markdown is a lightweight and easy-to-use syntax for styling your writing. It includes conventions for

Syntax highlighted code block

# Header 1
## Header 2
### Header 3

- Bulleted
- List

1. Numbered
2. List

**Bold** and _Italic_ and `Code` text

[Link](url) and ![Image](src)

For more details see GitHub Flavored Markdown.

Jekyll Themes

Your Pages site will use the layout and styles from the Jekyll theme you have selected in your repository settings. The name of this theme is saved in the Jekyll _config.yml configuration file.

Support or Contact

Having trouble with Pages? Check out our documentation or contact support and we’ll help you sort it out.

aristoteles's People

Contributors

Stargazers

Watchers

Forkers

tomputer22 cybersecurity-labs thugthink 5l1v3r1 ink-splatters

aristoteles's Issues

Field Names ARIstoteles vs. libARI.dylib

Field names in the dissector differ from log strings and function signatures in libARI.dylib. This may be relevant and should probably be documented. Examples:

ARIstoteles	`libARI.dylib`
Group	gid or just g
Type id	mid or just m
ID (TLVs)	tid
Transaction	Either `ctx` (context) or `trx` (transaction).

Sample log strings:

(%s:%d) trying to pack gid(%d) mid(0x%03x) tid(%d) with sz(%zu) > max size(%zu)
(%s:%d) trying to pack gid(%d) mid(0x%03x) tid(%d) with sz(%zu) not multiple of element sz(%zu)
(%s:%d) UNKNOWN tlv with g(%d) m(0x%03x) tid(%d), ignored
(%s:%d) canceling ctx 0x%x gmid 0x%x %s
(%s:%d) Client (0x%x) cancelTrx(0x%x) done

Symbols for functions:

Symbol (frida)	Function signature
`_ZN6AriMsg9GetBufGidEPKhm`	`AriMsg::GetBufGid(uint32_t * buf, uint64_t len)`
`_ZN6AriMsg9GetBufMidEPKhm`	`AriMsg::GetBufMid(uint32_t * buf, uint64_t len)`
`_ZN6AriMsg9GetBufCtxEPKhm`	`AriMsg::GetBufCtx(uint32_t * buf, uint64_t len)`

Add Acknowledgement Option

When analyzing libARI.dylib there is a function that parses an acknowledgement option or flag from a given ARI header (AriMsg::GetBufAckOpt(uint32_t * buf, uint32_t len)). The option is the 4th bit of the 8th byte. Please see the attached frida script:

// ACK Option = Byte 8, Bit 4

var getAckOptPtr = Module.getExportByName("libARI.dylib", "_ZN6AriMsg12GetBufAckOptEPKhm");
var getAckOptFun = new NativeFunction(
            getAckOptPtr,
            'uint32',
            ['pointer', 'int32']);

var payloadBuf = Memory.alloc(12);

var ari = [0xde, 0xc0, 0x7e, 0xab, 0x00, 0x00, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00];
Memory.writeByteArray(payloadBuf, ari);
var a = getAckOptFun(payloadBuf, ari.length);

ari = [0xde, 0xc0, 0x7e, 0xab, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF];
Memory.writeByteArray(payloadBuf, ari);
var b = getAckOptFun(payloadBuf, ari.length);

a === b;

GMID = Group ID || 0 || Type ID || 000000000000000

See the following frida script for more information. I uses the AriMsg::GetBufGmid(uint32_t * buf, uint32_t len) function:

// GMID = GID || 0 || MID || 000000000000000; Proof

var getBufGmidPtr = Module.getExportByName("libARI.dylib", "_ZN6AriMsg10GetBufGmidEPKhm");
var getBufGmidFun = new NativeFunction(
            getBufGmidPtr,
            'uint32',
            ['pointer', 'int32']);

var payloadBuf = Memory.alloc(12);

var ari = [0xde, 0xc0, 0x7e, 0xab, 0xF8, 0x01, 0x00, 0x00, 0xc0, 0xFF, 0x00, 0x00];
Memory.writeByteArray(payloadBuf, ari);
var a = getBufGmidFun(payloadBuf, ari.length);

ari = [0xde, 0xc0, 0x7e, 0xab, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF];
Memory.writeByteArray(payloadBuf, ari);
var b = getBufGmidFun(payloadBuf, ari.length);

var c = 0xfdff8000; // === (0x3f << 26) | (0x03ff << 15)

a === b && b === c;

seemoo-lab / aristoteles Goto Github PK

aristoteles's Introduction

Welcome to GitHub Pages

Markdown

Jekyll Themes

Support or Contact

aristoteles's People

Contributors

Stargazers

Watchers

Forkers

aristoteles's Issues

Field Names ARIstoteles vs. libARI.dylib

Add Acknowledgement Option

Fix `tvbrange` for the group field

Remove Unknown Bit 7 in Byte 5

Add the "virtual" "GMID"-field

Recommend Projects

React

Vue.js

Typescript

TensorFlow

Django

Laravel

D3

Recommend Topics

javascript

web

server

Machine learning

Visualization

Game

Recommend Org

Facebook

Microsoft

Google

Alibaba

D3

Tencent