Skip to content

Instantly share code, notes, and snippets.

@0xallie
Last active August 9, 2023 19:45
Show Gist options
  • Save 0xallie/6478372ca1b10df36b73b1688b6eb0a3 to your computer and use it in GitHub Desktop.
Save 0xallie/6478372ca1b10df36b73b1688b6eb0a3 to your computer and use it in GitHub Desktop.
Get APNonce and generator on macOS / jailbroken iOS with root privileges (SIP can be enabled)
//
// main.m
// apnoncer
//
// Created by alexia on 2023-02-15.
//
@import CoreFoundation;
@import Foundation;
#import <dlfcn.h>
int main(int argc, const char *argv[]) {
@autoreleasepool {
if (geteuid() != 0) {
fprintf(stderr, "Error: This program must be run as root.\n");
return 1;
}
void *libMobileGestalt = dlopen("/usr/lib/libMobileGestalt.dylib", RTLD_LAZY);
CFStringRef (*MGCopyAnswer)(CFStringRef string) = dlsym(libMobileGestalt, "MGCopyAnswer");
NSNumber *ecid = (__bridge NSNumber *)MGCopyAnswer(CFSTR("UniqueChipID"));
printf("ECID (dec): %s\n", ecid.stringValue.UTF8String);
NSData *apnonce = (__bridge NSData *)MGCopyAnswer(CFSTR("ApNonce"));
if (!apnonce) {
fprintf(stderr, "Error: Unable to get APNonce\n");
} else {
NSMutableString *sbuf = [NSMutableString stringWithCapacity:apnonce.length * 2];
const unsigned char *buf = apnonce.bytes;
for (NSInteger i = 0; i < apnonce.length; i++) {
[sbuf appendFormat:@"%02lx", (unsigned long)buf[i]];
}
printf("APNonce: %s\n", sbuf.UTF8String);
}
NSData *generator = (__bridge NSData *)MGCopyAnswer(CFSTR("ApNonceRetrieve"));
if (!generator) {
fprintf(stderr, "Error: Unable to get generator\n");
} else {
NSMutableString *sbuf = [NSMutableString stringWithCapacity:generator.length * 2];
const unsigned char *buf = generator.bytes;
for (NSInteger i = generator.length - 1; i >= 0; i--) { // need to swap endianness
[sbuf appendFormat:@"%02lx", (unsigned long)buf[i]];
}
printf("Generator: 0x%s\n", sbuf.UTF8String);
}
}
return 0;
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment