leptos-null

Writing an iOS YouTube Music client

I’ve been using YouTube Music as my main music streaming service for almost a year and a half. The iOS client is great- I’ve never had a single complaint. It’s potentially one of the most bug free apps I’ve ever used, it has an extremely friendly, and simple, graphical interface, and the service itself is great.

I was curious how the client worked in terms of networking, and while curiosity may treat cats poorly, it lands researchers in black sites can provide a lot of insight.

Step 0

The first thing I do when reverse engineering a client is monitor HTTP requests while the application starts up, and when doing the tasks interested in. On a jailbroken iOS device, I use FLEX by FlipBoard.

leptos-null

//
//  LMApiaryDeviceCrypto.h
//
//  Created by Leptos on 11/18/18.
//  Copyright © 2018 Leptos. All rights reserved.
//

#import <Foundation/Foundation.h>

#define kYouTubeBase64EncodedProjectKey @"vOU14u6GkupSL2pLKI/B7L3pBZJpI8W92RoKHJOu3PY="

leptos-null

//
//  mach_slide.c
//
//  This code was based on functions from https://opensource.apple.com/source/dyld
//  See the Apple Public Source License https://www.opensource.apple.com/apsl
//
//  Created by Leptos on 5/11/19.
//

#include <string.h>

leptos-null

#import <Foundation/Foundation.h>
#import <mach-o/loader.h>

#if __has_include(<Kernel/kern/cs_blobs.h>)
#   import <Kernel/kern/cs_blobs.h>
#else
    /* some Darwin distributions don't provide the cs_blobs header
     * copy it from the macOS SDK if available, otherwise one of
     * https://opensource.apple.com/source/xnu/xnu-4903.221.2/osfmk/kern/cs_blobs.h.auto.html
     * https://github.com/apple/darwin-xnu/blob/a449c6a3b8014d9406c2ddbdc81795da24aa7443/osfmk/kern/cs_blobs.h

leptos-null

import sys

FAT_MAGIC = b'\xca\xfe\xba\xbe' # big endian
FAT_MAGIC_64 = b'\xca\xfe\xba\xbf' # big endian

MH_MAGIC_64 = b'\xfe\xed\xfa\xcf' # big endian
MH_CIGAM_64 = b'\xcf\xfa\xed\xfe' # little endian

CPU_TYPE_ARM64 = b'\x01\x00\x00\x0c' # big endian
CPU_SUBTYPE_IOS13 = b'\x00\x00\x00\x02' # big endian

leptos-null

import Foundation

struct OrderedSet<Element: Hashable>: Sequence {
    private var order: [Element]
    private var membership: Set<Element>
    
    func makeIterator() -> IndexingIterator<Array<Element>> {
        order.makeIterator()
    }
    

leptos-null

import Foundation

func redirectStdout(to path: String) throws {
    let (openResult, posixErrorCode) = path.withCString {
        // idea thanks to https://github.com/leptos-null/ClassDumpRuntime/blob/31e3601/classdumpctl/main.m#L456-L459
        // error checking thanks to https://github.com/leptos-null/Forest/blob/ba4b89a/Shared/Tar.swift#L172-L174
        let result = open($0, O_WRONLY | O_CREAT | O_TRUNC, 0o644)
        let globalError = errno // copy errno since it may change before we access it again later
        return (result, globalError)
    }

leptos-null

//
//  ios_image_app_url_dump
//
//  Created by Leptos on 2/19/19.
//  Copyright © 2019 Leptos. All rights reserved.
//

/* compile with:
 * $ clang -fobjc-arc -framework Foundation
 */

leptos-null

Cycript on Mojave

Cycript is a tool I find very helpful. It's an effective REPL for Objective-C. When I updated to macOS Mojave, I found that cycript no longer worked because it was linked against an old version of Ruby. After attempting to compile from source, I tried another solution. install_name_tool is an open source tool for modifying the names of linked shared libraries in a Mach-O.

Solution

$ install_name_tool -change /System/Library/Frameworks/Ruby.framework/Versions/2.0/usr/lib/libruby.2.0.0.dylib /System/Library/Frameworks/Ruby.framework/Versions/Current/usr/lib/libruby.dylib Cycript.lib/cycript-apl
$ install_name_tool -change /System/Library/Frameworks/Ruby.framework/Versions/2.0/usr/lib/libruby.2.0.0.dylib /System/Library/Frameworks/Ruby.framework/Versions/Current/usr/lib/libruby.dylib Cycript.lib/libcycript.dylib

leptos-null

import SwiftUI

extension ForEach {
    init<Base: Sequence>(enumerated base: Base, @ViewBuilder content: @escaping (Data.Element) -> Content) where Data == Array<EnumeratedSequence<Base>.Element>, ID == Base.Element, Content: View, ID: Identifiable {
        self.init(Array(base.enumerated()), id: \.element, content: content)
    }
    init<Base: Sequence>(enumerated base: Base, id: KeyPath<Base.Element, ID>, @ViewBuilder content: @escaping (Data.Element) -> Content) where Data == Array<EnumeratedSequence<Base>.Element>, Content: View {
        let basePath: KeyPath<EnumeratedSequence<Base>.Element, Base.Element> = \.element
        self.init(Array(base.enumerated()), id: basePath.appending(path: id), content: content)
    }