4 ms·
I was curious as to how Apple implemented AirDrop discovery (particularly the Contacts Only feature) because their documentation is helpful, but vague[1]. I spe
by conradev 12y ago
I was curious as to how Apple implemented AirDrop discovery (particularly the Contacts Only feature) because their documentation is helpful, but vague[1]. I spent a night reverse engineering it, and this is the process:
1. Alice opens the AirDrop sheet.
2. Alice begins advertising her short "proximity"[2] hashes over BTLE.
3. Bob, continually scanning in the background, sees Alice and her hashes.
4. If Bob either a) has the "Everyone" setting enabled, or b) has a match to one of Alice's proximity hashes in his contacts, Bob connects to Alice over AWDL.
6. Bob starts a HTTP server.
7. Bob advertises a Bonjour service for his HTTP server.
8. Alice sends a discovery request.
9. If the request is valid, Bob sends a discovery response (including device model, name and icon).
Also to note, the author, Mario Ciabarra is the (co?)-founder of Rock Your Phone, the alternative to Cydia until the two merged in 2010[3].
[1] https://www.apple.com/privacy/docs/iOS_Security_Guide_Oct_2014.pdf https://www.apple.com/privacy/docs/iOS_Security_Guide_Oct_20... (Page 23)
[2] Each device hashes every phone number and email in its address book with SHA256 after normalizing them. These hashes are referred to as full hashes. The "proximity" hashes are the first two bytes of the long hash. The full hashes are not broadcasted, but they are verified later over AWDL.
[3] http://www.tuaw.com/2010/09/11/alliance-of-the-jailbreakers-cydia-acquires-rock/ http://www.tuaw.com/2010/09/11/alliance-of-the-jailbreakers-...
- geekam 12y agoVery interesting. How did you go about reverse engineering it? Would you mind sharing?
- conradev 12y agoSure! It's a combination of static and dynamic analysis. I have a jailbroken phone, which allows me to access any file on the filesystem and decrypt any App Store binaries[1]. The first step is to find in which binaries the functionality lives. I know from searching that AirDrop lives in Sharing.framework[2], which has a supporting daemon, sharingd. Then, I open the binaries in a disassembler like IDA Pro[3] or Hopper[4] to determine how they work. Running class-dump is also helpful[5]. If I need to inspect a process like sharingd at runtime, I use Cycript[6], which gives me an Objective-C REPL into the process, or LLDB[7]. [1] https://github.com/stefanesser/dumpdecrypted https://github.com/stefanesser/dumpdecrypted [2] https://github.com/JaviSoto/iOS8-Runtime-Headers/tree/master/PrivateFrameworks/Sharing.framework https://github.com/JaviSoto/iOS8-Runtime-Headers/tree/master... [3] https://www.hex-rays.com/products/ida/ https://www.hex-rays.com/products/ida/ [4] http://www.hopperapp.com/ http://www.hopperapp.com/ [5] http://stevenygard.com/projects/class-dump/ http://stevenygard.com/projects/class-dump/ [6] http://www.cycript.org/ http://www.cycript.org/ [7] http://iphonedevwiki.net/index.php/Debugserver http://iphonedevwiki.net/index.php/Debugserver
- coldpie 12y agoOh crap, I didn't know IDA was free for non-commercial use. I thought it was like Photoshop: prohibitively expensive for most users, so everyone pirates it. I'm going to have to give that a shot.
- TillE 12y agoAn old version is free, and lacking the decompiler. It's a good tool, but it's really not IDA Pro.
- reubenmorais 12y agoIDA is not the expensive part, the Hex-Rays decompiler is. A single license can cost up to $2000 :(
- edeion 12y agoMaybe you'd like Radare, which is free software. http://www.radare.org/y/ http://www.radare.org/y/
- coldpie 12y agoThank you for the link.
- udalov 12y agoThe free version is also Windows-only