Add offsets for High Sierra, Mojave and Catalina #12

jetfir3 · 2023-12-29T19:03:24Z

10.13.6
10.14.6
10.15.1
10.15.2
10.15.3
10.15.4
10.15.5
10.15.6/7
x86_64 only as these macOS versions do not support arm64
macOS 10.14 and earlier lack the "IDSProtoKeyTransparencyTrustedServiceReadFrom" symbol so another reference symbol was used for 10.14.6

I was able to successfully register Beeper Mini on both macOS 10.14.6 and 10.15.3.
Each binary version was disassembled and offsets manually found... so the other 10.15.x offsets should good.

Update: I have also added a PR to the beeper/imessage repo to resolve the Beeper Mini crash another way, beeper/imessage#11

Update 2: High Sierra 10.13.6 offsets added

- 10.14.6 - 10.15.1 - 10.15.2 - 10.15.3 - 10.15.4 - 10.15.5 - 10.15.6/7 - x86_64 only has these macOS versions do not support arm64 - macOS 10.14 and earlier lack the "IDSProtoKeyTransparencyTrustedServiceReadFrom" symbol so another reference symbol was used for 10.14.6 - each binary version was disassembled and offsets manually found

0xdevalias · 2023-12-30T07:14:23Z

nac/offsets.go

@@ -168,4 +239,4 @@ func hexToByte32(val string) [32]byte {
 		panic(fmt.Errorf("expected 32 bytes, got %d", len(out)))
 	}
 	return *(*[32]byte)(out)
-}
+}


Seems the newline at the end of the file got removed in this change.

This should be fixed now.

Thanks for fixing that up, looks good :)

0xdevalias · 2023-12-30T07:15:19Z

@jetfir3 I just saw your PR to add a bunch of other offsets (#12), and was wondering if you'd be able to upload the identityservicesd binaries for those versions somewhere as per this comment so I can test/refine my auto-offset-finding code.

Originally posted by @0xdevalias in #9 (comment)

- 10.13.6

0xdevalias · 2024-01-01T22:25:37Z

README.md

@@ -6,7 +6,7 @@ registration code and use it in Beeper Mini.
 ## Supported MacOS versions
 The tool is currently quite hacky, so it only works on specific versions of macOS.

-* Intel: 11.5 - 11.7, 13.3.1, 13.5 - 13.6, 14.0 - 14.3
+* Intel: 10.14.6, 10.15.1 - 10.15.7, 11.5 - 11.7, 13.3.1, 13.5 - 13.6, 14.0 - 14.3


Since the High Sierra offsets were added in e018389 (#12), this should be updated:

Suggested change

* Intel: 10.14.6, 10.15.1 - 10.15.7, 11.5 - 11.7, 13.3.1, 13.5 - 13.6, 14.0 - 14.3

* Intel: 10.13.6, 10.14.6, 10.15.1 - 10.15.7, 11.5 - 11.7, 13.3.1, 13.5 - 13.6, 14.0 - 14.3

I have not confirmed if Go binaries built by a macOS 11 runner will run on macOS 10.13.6.

The macOS 13 runner is currently used by default and macOS 10.14.x is unable to run the Go binary so my other PR lowers the runner to macOS 11 which does allow macOS 10.14.x to run the built binary... but someone on macOS 10.13.6 would need to test if the Go binary built on macOS 11 also runs on macOS 10.13.6.

For this reason, I was unsure if listing macOS 10.13.6 prior to confirmation was ideal. Yes, the project would run on macOS 10.13.6 if built locally on a machine running said version but official "Releases" in the repo may or may not.

I have no issues adding macOS 10.13.6 to README via this current PR if others think it should be added.

Fair enough, that makes sense. My thought was mostly because you added the offsets for 10.13.6, so the tool would work on a binary from that version of macOS (eg. if running on another machine)

As for the specifics you mention above, I'll delegate to letting someone 'official' answer that; this was just my personal /2c.

I should also note, I can also post offsets for 10.12, 10.11 etc.. but I stopped at 10.13.6 (last High Sierra update) due to the macOS11 runner generated binaries likely not working below 10.13.6 (possibly not even 10.13.6).

If members officially tied to the project wouldn't mind us adding offsets the auto-builds can't support, requiring users to build themselves, I will add the additional offsets. The other PRs I've made to add support for 10.15 and below should with 10.12, 10.11, 10.10, 10.9, 10.8, 10.7... and possibly lower. Though we then might run into issues with the OS not supporting Go or the current Go code properly.

So... how low can we go? :)

Curious, how do you have access to the older binaries? Extracting them from Time Machine backups/similar, or?

Downloading macOS and extracting the binary for each version.

https://github.com/corpnewt/gibMacOS
https://support.apple.com/kb/DL2052
etc

Oh cool! Didn't know about that :)

I should also note, I can also post offsets for 10.12, 10.11 etc.. but I stopped at 10.13.6 (last High Sierra update) due to the macOS11 runner generated binaries likely not working below 10.13.6 (possibly not even 10.13.6)

@jetfir3 It's sort of OOS of this PR, but I noticed that there are currently hashes for 12.6.3 / 13.2.1, but seemingly no offsets for them. Are those versions you're able to access with your method above? (Ref):

mac-registration-provider/nac/offsets.go

Lines 128 to 131 in 4b28b39

// macOS 12.6.3

hexToByte32("6e8caf477c2b4d3a56a91835a2b6455f36fb0feb13006def7516ac09578c67d0"): {},

// macOS 13.2.1

hexToByte32("4d96de9438fdea5b0b7121e485541ecf0a74489eeb330c151a7d44d289dd3a85"): {},

Also, a few other issues that seem to be seeking different versions, if you were interested:

Not working please help #10

11.0.1/20B29/amd64 (hash: 1a9cc9305e1621a2024a0f2c70fe77af0d0cf1fbd7e971ecd443f2fd587b12fc)

macOS Ventura Error: No offsets found for 13.6.1/22G313/amd64 #17

13.6.1/22G313/amd64 (hash: fff8db27fef2a2b874f7bc6fb303a98e3e3b8aceb8dd4c5bfa2bad7b76ea438a)

Doesn't run on 14.1 Beta (23B5056e) #6

14.1 Beta (23B5056e)

smizles · 2024-01-02T21:04:31Z

Praying this PR gets merged soon because the only iMac I have access to for use with Beeper is old and can't be upgraded past High Sierra 10.13.6...

jetfir3 added 2 commits December 29, 2023 13:59

Update Supported MacOS Versions

e49c88d

0xdevalias mentioned this pull request Dec 30, 2023

Automatically find/calculate offsets in binaries that haven't been manually reversed #9

Open

0xdevalias reviewed Dec 30, 2023

View reviewed changes

jetfir3 and others added 2 commits December 30, 2023 14:03

Fix newline at end of file

5f8552d

Merge branch 'main' into offsets

b2146c5

jetfir3 mentioned this pull request Jan 1, 2024

Add "pre-Catalina" support #15

Merged

Add High Sierra Offsets

e018389

- 10.13.6

jetfir3 changed the title ~~Add offsets for Mojave and Catalina~~ Add offsets for High Sierra, Mojave and Catalina Jan 1, 2024

0xdevalias reviewed Jan 1, 2024

View reviewed changes

This was referenced Jan 6, 2024

macOS Ventura Error: No offsets found for 13.6.1/22G313/amd64 #17

Closed

Doesn't run on 14.1 Beta (23B5056e) #6

Closed

add offsets for 12.7.1 (x86/arm64) #18

Merged

tulir merged commit eda742b into beeper:main Jan 9, 2024
1 check passed

0xdevalias mentioned this pull request Apr 15, 2024

Zipped identityservicesd on Intel Core i5, macOS 10.14.6 #47

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add offsets for High Sierra, Mojave and Catalina #12

Add offsets for High Sierra, Mojave and Catalina #12

jetfir3 commented Dec 29, 2023 •

edited

Loading

0xdevalias Dec 30, 2023

jetfir3 Dec 30, 2023

0xdevalias Dec 30, 2023

0xdevalias commented Dec 30, 2023

0xdevalias Jan 1, 2024

jetfir3 Jan 1, 2024

0xdevalias Jan 2, 2024

jetfir3 Jan 2, 2024

0xdevalias Jan 3, 2024

jetfir3 Jan 3, 2024

0xdevalias Jan 3, 2024

0xdevalias Jan 6, 2024 •

edited

Loading

smizles commented Jan 2, 2024 •

edited

Loading

	* Intel: 10.14.6, 10.15.1 - 10.15.7, 11.5 - 11.7, 13.3.1, 13.5 - 13.6, 14.0 - 14.3
	* Intel: 10.13.6, 10.14.6, 10.15.1 - 10.15.7, 11.5 - 11.7, 13.3.1, 13.5 - 13.6, 14.0 - 14.3

	// macOS 12.6.3
	hexToByte32("6e8caf477c2b4d3a56a91835a2b6455f36fb0feb13006def7516ac09578c67d0"): {},
	// macOS 13.2.1
	hexToByte32("4d96de9438fdea5b0b7121e485541ecf0a74489eeb330c151a7d44d289dd3a85"): {},

Add offsets for High Sierra, Mojave and Catalina #12

Add offsets for High Sierra, Mojave and Catalina #12

Conversation

jetfir3 commented Dec 29, 2023 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

0xdevalias commented Dec 30, 2023

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

0xdevalias Jan 6, 2024 • edited Loading

Choose a reason for hiding this comment

smizles commented Jan 2, 2024 • edited Loading

jetfir3 commented Dec 29, 2023 •

edited

Loading

0xdevalias Jan 6, 2024 •

edited

Loading

smizles commented Jan 2, 2024 •

edited

Loading