All the values that iOS grants when using the ‘com.apple.private.MobileGestalt.AllowedProtectedKeys‘ entitlement

MGAllowedProtectedKeys.xml

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>com.apple.private.MobileGestalt.AllowedProtectedKeys</key>
	<array>
		<string>AWDID</string>
		<string>AmbientLightSensorSerialNumber</string>
		<string>ArcModuleSerialNumber</string>
		<string>ArrowChipID</string>
		<string>ArrowUniqueChipID</string>
		<string>BasebandBoardSnum</string>
		<string>BasebandChipId</string>
		<string>BasebandSerialNumber</string>
		<string>BasebandUniqueId</string>
		<string>BatterySerialNumber</string>
		<string>BluetoothAddress</string>
		<string>BluetoothAddressData</string>
		<string>BootManifestHash</string>
		<string>CarrierBundleInfoArray</string>
		<string>CompassCalibration</string>
		<string>CompassCalibrationDictionary</string>
		<string>ConfigNumber</string>
		<string>CoverglassSerialNumber</string>
		<string>DiagData</string>
		<string>DieId</string>
		<string>DisplayDriverICChipID</string>
		<string>EUICCChipID</string>
		<string>EthernetMacAddress</string>
		<string>EthernetMacAddressData</string>
		<string>FrontFacingCameraModuleSerialNumber</string>
		<string>FrontFacingIRCameraModuleSerialNumber</string>
		<string>FrontFacingIRStructuredLightProjectorModuleSerialNumber</string>
		<string>IceFallID</string>
		<string>IntegratedCircuitCardIdentifier</string>
		<string>IntegratedCircuitCardIdentifier2</string>
		<string>InternationalMobileEquipmentIdentity</string>
		<string>InternationalMobileEquipmentIdentity2</string>
		<string>InverseDeviceID</string>
		<string>JasperSerialNumber</string>
		<string>LunaFlexSerialNumber</string>
		<string>LynxPublicKey</string>
		<string>LynxSerialNumber</string>
		<string>MLBSerialNumber</string>
		<string>MesaSerialNumber</string>
		<string>MobileEquipmentIdentifier</string>
		<string>MobileEquipmentInfoBaseId</string>
		<string>MobileEquipmentInfoBaseProfile</string>
		<string>MobileEquipmentInfoBaseVersion</string>
		<string>MobileEquipmentInfoCSN</string>
		<string>MobileEquipmentInfoDisplayCSN</string>
		<string>MultiLynxPublicKeyArray</string>
		<string>MultiLynxSerialNumberArray</string>
		<string>NandControllerUID</string>
		<string>PanelSerialNumber</string>
		<string>PhoneNumber</string>
		<string>PhoneNumber2</string>
		<string>PintoMacAddress</string>
		<string>PintoMacAddressData</string>
		<string>ProximitySensorCalibration</string>
		<string>ProximitySensorCalibrationDictionary</string>
		<string>RawPanelSerialNumber</string>
		<string>RearFacingCameraModuleSerialNumber</string>
		<string>RearFacingSuperWideCameraModuleSerialNumber</string>
		<string>RearFacingTelephotoCameraModuleSerialNumber</string>
		<string>RemoteBluetoothAddress</string>
		<string>RemoteBluetoothAddressData</string>
		<string>RosalineSerialNumber</string>
		<string>RoswellChipID</string>
		<string>SavageChipID</string>
		<string>SavageInfo</string>
		<string>SavageSerialNumber</string>
		<string>SavageUID</string>
		<string>ScreenSerialNumber</string>
		<string>SecondaryBluetoothMacAddress</string>
		<string>SecondaryBluetoothMacAddressData</string>
		<string>SecondaryEthernetMacAddress</string>
		<string>SecondaryEthernetMacAddressData</string>
		<string>SecondaryWifiMacAddress</string>
		<string>SecondaryWifiMacAddressData</string>
		<string>SecureElementID</string>
		<string>SerialNumber</string>
		<string>SysCfg</string>
		<string>SysCfgDict</string>
		<string>TopModuleAuthChipID</string>
		<string>TristarID</string>
		<string>UniqueChipID</string>
		<string>UniqueDeviceID</string>
		<string>UniqueDeviceIDData</string>
		<string>WifiAddress</string>
		<string>WifiAddressData</string>
		<string>WirelessBoardSnum</string>
		<string>YonkersChipID</string>
		<string>YonkersSerialNumber</string>
		<string>YonkersUID</string>
	</array>
</dict>
</plist>

simple_but_effective.xml

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>com.apple.CommCenter.fine-grained</key>
	<array>
		<string>spi</string>
		<string>identity</string>
	</array>
	<key>com.apple.private.MobileGestalt.AllowedProtectedKeys</key>
	<true/>
</dict>
</plist>

Hi @dlevi309 , do you know which key can get CSN/EID?
I try to run key MobileEquipmentInfoCSN and MobileEquipmentInfoDisplayCSN, but the result is empty.
Please advise !

@truonggiang0710 I don’t think you can from MobileGestalt, it will always return NULL; (from my tests at least)

Hi @dlevi309 , Do you have any ideas for that? libimobiledevice/libimobiledevice#790

eeid - or thats what it is in FDR, EUICCChipID?

@rickmark it’s still returns a NULL (error 0) code, I don’t think you can query eeid through MobileGestalt anymore (I don’t know if it was ever available)

@TrungNguyen1909 To answer your question actually the codes are as follows:

MobileEquipmentInfoDisplayCSN = zPHFWx4ZItDiTXNT2onrWQ
MobileEquipmentInfoCSN = rkFHO5dZmWxy3QdOx7r7kA
InternationalMobileEquipmentIdentity = QZgogo2DypSAZfkRW4dP/A
MobileEquipmentIdentifier = xOEH0P1H/1jmYe2t54+5cQ

InternationalMobileEquipmentIdentity2 = xRyzf9zFE/ycr/wJPweZvQ
and I’ve confirmed those values work with the guesstalt tool found here

EID is different from IMEI/MEID - its a special ICCID for enrollment - did you try those values obfuscated or?

@rickmark this was to answer his question of getting the values MobileEquipmentInfoCSN + MobileEquipmentInfoDisplayCSN, and I just don’t think that MobileGestalt supports fetching the EID, and I tried them both (obfuscated / english — they both return the same values for those keys) I’m using my own lightly updated version of guesstalt, if you want, I could send it to you? You can play around with it, it still uses the depreciated CC_MD5 to calculate values but works well enough.

Oh it must be possible somehow, prob a separate entitlement - look into T-Mobile’s prepaid app, it can do eSIM provisioning

Finally, we still don't have any way to get EID/CSN, @rickmark, @dlevi309

@rickmark Think I found it.

FirmwarePreflightInfo is a dictionary that produces a bunch of items (one of them being EUICCCSN which is the EID and the other is BasebandFirmwareUpdateInfo which produces a dictionary of 21 items, with kVinylFwUpdateCsn being the EID.

oh awesome - mind if i add that to https://github.com/hack-different/apple-knowledge/blob/main/_data/mobile_gestalt.yaml or would you like to so that it's credited?

@rickmark not a problem- and thank you for asking, but you go on ahead :)