leptos-null

Writing an iOS YouTube Music client

I’ve been using YouTube Music as my main music streaming service for almost a year and a half. The iOS client is great- I’ve never had a single complaint. It’s potentially one of the most bug free apps I’ve ever used, it has an extremely friendly, and simple, graphical interface, and the service itself is great.

I was curious how the client worked in terms of networking, and while curiosity may treat cats poorly, it lands researchers in black sites can provide a lot of insight.

Step 0

The first thing I do when reverse engineering a client is monitor HTTP requests while the application starts up, and when doing the tasks interested in. On a jailbroken iOS device, I use FLEX by FlipBoard.

leptos-null

## Protobuf syntax highlighting for nano by Leptos
## Based off creekpld's Swift syntax highlighter

syntax "Protobuf" "\.proto$"

# Default
color white ".+"

# Keywords
color yellow "^ *\<(syntax|package|import|option)\>"

leptos-null

YTIThumbnailDetails classdump notes

While class dumping YouTube Music, I ran into two problematic properties in a protobuf-generated class.

The property largestImageSource had the type encoding

{YTImageSource=@@{YTClientResource=@@{optional<unsigned int>=B(?={dummy_type=[4{empty_struct=}]}I)}}{optional<unsigned int>=B(?={dummy_type=[4{empty_struct=}]}I)}{optional<unsigned int>=B(?={dummy_type=[4{empty_struct=}]}I)}}

leptos-null

//
//  LMApiaryDeviceCrypto.h
//
//  Created by Leptos on 11/18/18.
//  Copyright © 2018 Leptos. All rights reserved.
//

#import <Foundation/Foundation.h>

#define kYouTubeBase64EncodedProjectKey @"vOU14u6GkupSL2pLKI/B7L3pBZJpI8W92RoKHJOu3PY="

leptos-null

Mojave Dynamic Desktop- How it works

Prompted by a tweet by NSHipster, and a subsequent thread, I wanted to find out how Mojave dynamic wallpapers worked. NSHipster and ole reverse engineered the file format. In the Twitter thread, NSHipster mentions an edge case: What happens above 66ºN (latitude)?

The first thing to do was find out what process handles the wallpaper on macOS. I primarily do iOS research, and honestly had no idea. I opened Console, searched for "solar", and then changed my static wallpaper to a dynamic one. Voila!

Message: index: 7 next: 14815.999366

Process: Dock

leptos-null

Cycript on Mojave

Cycript is a tool I find very helpful. It's an effective REPL for Objective-C. When I updated to macOS Mojave, I found that cycript no longer worked because it was linked against an old version of Ruby. After attempting to compile from source, I tried another solution. install_name_tool is an open source tool for modifying the names of linked shared libraries in a Mach-O.

Solution

$ install_name_tool -change /System/Library/Frameworks/Ruby.framework/Versions/2.0/usr/lib/libruby.2.0.0.dylib /System/Library/Frameworks/Ruby.framework/Versions/Current/usr/lib/libruby.dylib Cycript.lib/cycript-apl
$ install_name_tool -change /System/Library/Frameworks/Ruby.framework/Versions/2.0/usr/lib/libruby.2.0.0.dylib /System/Library/Frameworks/Ruby.framework/Versions/Current/usr/lib/libruby.dylib Cycript.lib/libcycript.dylib

leptos-null

//
//  main.c
//  polymaths
//
//  Created by Leptos on 9/18/18.
//  Copyright © 2018 Leptos. All rights reserved.
//

#include <stdio.h>
#include <math.h>

leptos-null

function lw() {
	for ARG in "$@"
	do
		WHICH_RESULT=$(which "$ARG") && {
			[[ -e "$WHICH_RESULT" ]] && {
				l "$WHICH_RESULT"
				continue
			}
		}
		echo "$WHICH_RESULT"

leptos-null

## LLVM syntax highlighting for nano by Leptos
## Based off the official nano C/C++ template

syntax ll "\.ll$"
magic "LLVM source"
comment ";"

# all numeral literals
color brightcyan "-?[0-9]*"

leptos-null

Cydia Virtual Dependency Packages

Cydia provides "virtual dependency" packages, leveraging dpkg, to allow packages to only be installed on certain kinds of devices.

I have not been able to find official documentation on these packages. Their package names are prefixed with "cy+". To find out exactly what these packages represented I ran a few command on two devices.

Testing

iPhone 5, iOS 10.3.3: