SMSLess registration

TaeHagen · TaeHagen · commit 0164eeacb3e4 · 2025-10-30T18:06:06.000-07:00
diff --git a/src/auth.rs b/src/auth.rs
@@ -2,6 +2,7 @@ use std::{collections::HashMap, io::Cursor, marker::PhantomData, str::FromStr, s
 
 use aes::{cipher::consts::U16, Aes128};
 use cloudkit_proto::{octagon_pairing_message::{self, Step5}, CuttlefishPeer, OctagonPairingMessage, OctagonWrapper, SignedInfo};
+use deku::{DekuRead, DekuWrite};
 use hkdf::Hkdf;
 use icloud_auth::{AppleAccount, CircleSendMessage, LoginState};
 use log::{debug, info, warn};
@@ -17,8 +18,9 @@ use tokio::sync::{watch, Mutex};
 use uuid::Uuid;
 use rand::Rng;
 use aes_gcm::{Aes128Gcm, KeyInit, Nonce, aead::Aead};
+use deku::{DekuContainerWrite, DekuUpdate};
 
-use crate::{aps::{get_message, APSInterestToken}, ids::user::{IDSUser, IDSUserIdentity, IDSUserType}, keychain::{EncodedPeer, KeychainClient}, util::{base64_decode, base64_encode, decode_hex, duration_since_epoch, encode_hex, get_bag, gzip, gzip_normal, plist_to_bin, plist_to_buf, plist_to_string, ungzip, KeyPair, IDS_BAG, REQWEST}, APSConnection, APSConnectionResource, APSMessage, APSState, OSConfig, PushError};
+use crate::{APSConnection, APSConnectionResource, APSMessage, APSState, OSConfig, PushError, aps::{APSInterestToken, get_message}, ids::user::{IDSUser, IDSUserIdentity, IDSUserType}, keychain::{EncodedPeer, KeychainClient}, util::{IDS_BAG, KeyPair, PhoneNumberResponse, REQWEST, base64_decode, base64_encode, decode_hex, duration_since_epoch, encode_hex, get_bag, gzip, gzip_normal, plist_to_bin, plist_to_buf, plist_to_string, ungzip}};
 
 #[derive(Serialize)]
 #[serde(rename_all = "kebab-case")]
@@ -272,7 +274,7 @@ struct AuthCertResponse {
     cert: Data,
 }
 
-async fn authenticate(os_config: &dyn OSConfig, user_id: &str, request: Value, user_type: IDSUserType) -> Result<IDSUser, PushError> {
+fn generate_auth_csr(user_id: &str) -> Result<(PKey<Private>, Vec<u8>), PushError> {
     let key = PKey::from_rsa(Rsa::generate(2048)?)?;
     
     let mut name = X509Name::builder()?;
@@ -284,9 +286,15 @@ async fn authenticate(os_config: &dyn OSConfig, user_id: &str, request: Value, u
     csr.set_subject_name(&name.build())?;
     csr.sign(&key, MessageDigest::sha1())?;
 
+    Ok((key, csr.build().to_der()?))
+}
+
+async fn authenticate(os_config: &dyn OSConfig, user_id: &str, request: Value, user_type: IDSUserType) -> Result<IDSUser, PushError> {
+    let (key, csr) = generate_auth_csr(user_id)?;
+
     let auth_cert = AuthCertRequest {
         authentication_data: request,
-        csr: csr.build().to_der()?.into(),
+        csr: csr.into(),
         realm_user_id: user_id.to_string(),
     };
 
@@ -337,6 +345,104 @@ pub async fn authenticate_phone(number: &str, phone: AuthPhone, os_config: &dyn
     authenticate(os_config, &format!("P:{number}"), plist::to_value(&phone)?, IDSUserType::Phone).await
 }
 
+pub async fn authenticate_smsless(auth: &PhoneNumberResponse, host: &str, os_config: &dyn OSConfig, aps: &APSConnection) -> Result<IDSUser, PushError> {
+
+    #[derive(DekuWrite, Clone, Debug)]
+    #[deku(endian = "big")]
+    struct SMSLessSig {
+        header: u16,
+        domain_len: u8,
+        domain: Vec<u8>,
+        carrier_len: u16,
+        carrier: Vec<u8>,
+    }
+
+    let stripped_host =  Url::parse(host).expect("Failed to parse host").domain().expect("No domain name?").to_string();
+    let sig_data = base64_decode(&auth.signature);
+    let sig = SMSLessSig {
+        header: 0x0200,
+        domain_len: stripped_host.len() as u8,
+        domain: stripped_host.as_bytes().to_vec(),
+        carrier_len: sig_data.len() as u16,
+        carrier: sig_data,
+    };
+    
+
+    let user_id = format!("P:{}", auth.phone_number);
+
+    #[derive(Serialize)]
+    #[serde(rename_all = "kebab-case")]
+    struct SmslessAuthRequest {
+        csr: Data,
+        sig: Data,
+        tag: String,
+        user_id: String,
+    }
+
+    let (key, csr) = generate_auth_csr(&user_id)?;
+
+    let request = SmslessAuthRequest {
+        csr: csr.into(),
+        sig: sig.to_bytes()?.into(),
+        tag: "SIM1".to_string(),
+        user_id: user_id.clone(),
+    };
+
+    #[derive(Serialize)]
+    #[serde(rename_all = "kebab-case")]
+    struct AuthMultipleUsers {
+        push_token: Data,
+        authentication_requests: Vec<SmslessAuthRequest>,
+    }
+
+    let users = AuthMultipleUsers {
+        push_token: aps.get_token().await.to_vec().into(),
+        authentication_requests: vec![request]
+    };
+
+    let url = get_bag(IDS_BAG, "id-authenticate-multiple-users").await?.into_string().unwrap();
+
+    let resp = REQWEST.post(url)
+        .header("user-agent", format!("com.apple.invitation-registration {}", os_config.get_version_ua()))
+        .header("x-protocol-version", os_config.get_protocol_version())
+        .header("content-encoding", "gzip")
+        .body(gzip_normal(&plist_to_buf(&users)?)?)
+        .send().await?
+        .bytes().await?;
+
+    #[derive(Deserialize)]
+    #[serde(rename_all = "kebab-case")]
+    struct ResponseMultipleUsers {
+        authentication_responses: Vec<SmslessAuthResponse>,
+    }
+
+    #[derive(Deserialize)]
+    #[serde(rename_all = "kebab-case")]
+    struct SmslessAuthResponse {
+        cert: Data,
+        user_id: String,
+        status: u32,
+    }
+
+    let mut result: ResponseMultipleUsers = plist::from_bytes(&resp)?;
+
+    let response = result.authentication_responses.remove(0);
+
+    if response.status != 0 {
+        return Err(PushError::CertError(plist::from_bytes(&resp)?))
+    }
+
+    let keypair = KeyPair { cert: response.cert.into(), private: key.private_key_to_der()? };
+    
+    Ok(IDSUser {
+        auth_keypair: keypair,
+        user_id: user_id.to_string(),
+        registration: HashMap::new(),
+        user_type: IDSUserType::Phone,
+        protocol_version: os_config.get_protocol_version(),
+    })
+}
+
 pub enum NonceType {
     HTTP,
     APNS,
diff --git a/src/error.rs b/src/error.rs
@@ -187,4 +187,6 @@ pub enum PushError {
     MasterKeyNotFound,
     #[error("Resource Stalled!")]
     ResourceStalled,
+    #[error("ICC Auth failed!")]
+    ICCAuthFailed,
 }
diff --git a/src/lib.rs b/src/lib.rs
@@ -39,11 +39,11 @@ use icloud_auth::LoginClientInfo;
 pub use imessage::messages::{TypingApp, SetTranscriptBackgroundMessage, UpdateProfileMessage, UpdateProfileSharingMessage, MessageInst, ShareProfileMessage, SharedPoster, ScheduleMode, PermanentDeleteMessage, OperatedChat, DeleteTarget, MoveToRecycleBinMessage, TextFormat, TextEffect, TextFlags, LinkMeta, LPLinkMetadata, ReactMessageType, ErrorMessage, Reaction, UnsendMessage, EditMessage, UpdateExtensionMessage, PartExtension, ReactMessage, ChangeParticipantMessage, LPImageMetadata, RichLinkImageAttachmentSubstitute, LPIconMetadata, AttachmentType, ExtensionApp, BalloonLayout, Balloon, ConversationData, Message, MessageType, Attachment, NormalMessage, RenameMessage, IconChangeMessage, MessageParts, MessagePart, MMCSFile, IndexedMessagePart};
 pub use imessage::aps_client::{IMClient, MADRID_SERVICE};
 use util::encode_hex;
-pub use util::{NSArrayClass, ResourceState, NSDictionaryClass, NSURL, NSArray, ResourceFailure, NSAttributedString, NSString, NSDictionaryTypedCoder, NSNumber, coder_encode_flattened, coder_decode_flattened, StCollapsedValue};
+pub use util::{NSArrayClass, EntitlementsResponse, EntitlementAuthState, ResourceState, NSDictionaryClass, NSURL, NSArray, ResourceFailure, NSAttributedString, NSString, NSDictionaryTypedCoder, NSNumber, coder_encode_flattened, coder_decode_flattened, StCollapsedValue};
 pub use ids::user::{IDSUser, register, IDSUserIdentity, IDSNGMIdentity, PrivateDeviceInfo, SupportAlert, SupportAction, ReportMessage};
 pub use ids::identity_manager::{SendJob, MessageTarget, IdentityManager};
 pub use ids::CertifiedContext;
-pub use auth::{authenticate_apple, login_apple_delegates, authenticate_phone, AuthPhone, LoginDelegate, CircleClientSession, TokenProvider};
+pub use auth::{authenticate_apple, login_apple_delegates, authenticate_phone, authenticate_smsless, AuthPhone, LoginDelegate, CircleClientSession, TokenProvider};
 pub use error::PushError;
 pub use cloudkit_proto;
 pub use cloudkit_derive;
diff --git a/src/util.rs b/src/util.rs
@@ -1,4 +1,5 @@
 use std::collections::{HashMap, HashSet};
+use std::future::Future;
 use std::io::Cursor;
 use std::num::ParseIntError;
 use std::ops::{Deref, DerefMut, Range};
@@ -23,8 +24,9 @@ use base64::Engine;
 use prost::Message;
 use reqwest::header::{HeaderMap, HeaderValue};
 use reqwest::{Certificate, Client, Proxy};
-use serde::de::value;
+use serde::de::{DeserializeOwned, value};
 use serde::{Deserialize, Deserializer, Serialize, Serializer};
+use serde_json::json;
 use sha2::{Digest, Sha256};
 use thiserror::Error;
 use tokio::select;
@@ -35,12 +37,12 @@ use uuid::Uuid;
 use std::io::{Write, Read};
 use std::fmt::{Display, Write as FmtWrite};
 
-use rand::thread_rng;
+use rand::{Rng, thread_rng};
 use rand::seq::SliceRandom;
 use futures::FutureExt;
 
 use crate::ids::CompactECKey;
-use crate::PushError;
+use crate::{APSConnection, OSConfig, PushError};
 
 pub const APNS_BAG: &str = "http://init-p01st.push.apple.com/bag";
 pub const IDS_BAG: &str = "https://init.ess.apple.com/WebObjects/VCInit.woa/wa/getBag?ix=3";
@@ -453,11 +455,51 @@ impl CarrierAddress {
 #[serde(rename_all = "PascalCase")]
 struct Carrier {
     phone_number_registration_gateway_address: CarrierAddress,
+    carrier_entitlements: CarrierEntitlements,
 }
 
 const CARRIER_CONFIG: &str = "https://itunes.apple.com/WebObjects/MZStore.woa/wa/com.apple.jingle.appserver.client.MZITunesClientCheck/version?languageCode=en";
 
-pub async fn get_gateways_for_mccmnc(mccmnc: &str) -> Result<String, PushError> {
+
+#[derive(Deserialize)]
+#[serde(rename_all = "PascalCase")]
+pub struct CarrierEntitlements {
+    server_address: String,
+    user_agent: Option<String>,
+    protocol_version: Option<String>,
+}
+
+impl CarrierEntitlements {
+    async fn invoke(&self, requests: &[serde_json::Value], config: &dyn OSConfig) -> Result<Vec<serde_json::Value>, PushError> {
+        let user_agent = self.user_agent.as_ref().map(|i| i.as_str()).unwrap_or("Entitlement/$version ($device) iOS/$iOSVersion ($build) Carrier Settings/$carrierBundleVersion")
+            .replace("$version", "2")
+            .replace("$device", "iPhone")
+            .replace("$iOSVersion", &config.get_debug_meta().user_version)
+            .replace("$build", &config.get_register_meta().software_version);
+
+        let value = gzip_normal(&serde_json::to_vec(requests)?)?;
+
+        Ok(REQWEST.post(&self.server_address)
+            .header("Content-Type", "application/json")
+            .header("x-country-iso-code", "us")
+            .header("Accept", "application/json")
+            .header("Content-Encoding", "gzip")
+            .header("User-Agent", format!("{} Carrier Settings/50.0.2", user_agent))
+            .header("Accept-Language", "en")
+            .header("Accept-Encoding", "gzip")
+            .header("x-protocol-version", self.protocol_version.as_ref().map(|i| i.as_str()).unwrap_or("2"))
+            .body(value)
+            .send().await?
+            .json().await?)
+    }
+}
+
+pub struct CarrierConfig {
+    pub gateway: String,
+    carrier: CarrierEntitlements,
+}
+
+pub async fn get_gateways_for_mccmnc(mccmnc: &str) -> Result<CarrierConfig, PushError> {
     let data = REQWEST.get(CARRIER_CONFIG)
         .send().await?;
     
@@ -482,13 +524,132 @@ pub async fn get_gateways_for_mccmnc(mccmnc: &str) -> Result<String, PushError>
         let mut out = vec![];
         archive.by_name(&carrier.to_string()).unwrap().read_to_end(&mut out)?;
 
+        info!("here {:?}", plist::from_bytes::<Value>(&out)?);
+
         let parsed_file: Carrier = plist::from_bytes(&out)?;
-        return Ok(parsed_file.phone_number_registration_gateway_address.vec().choose(&mut thread_rng()).ok_or(PushError::CarrierNotFound)?.clone())
+        return Ok(CarrierConfig {
+            gateway: parsed_file.phone_number_registration_gateway_address.vec().choose(&mut thread_rng()).ok_or(PushError::CarrierNotFound)?.clone(),
+            carrier: parsed_file.carrier_entitlements,
+        })
     }
 
     Err(PushError::CarrierNotFound)
 }
 
+#[derive(Serialize, Deserialize)]
+pub struct EntitlementAuthState {
+    device_account_identifier: String,
+    unique_id: String,
+    token: Option<String>,
+    subscriber: String,
+    mccmnc: String,
+}
+
+fn find_entitlement_result<T: DeserializeOwned>(entitlements: &[serde_json::Value], id: u64) -> Result<T, PushError> {
+    let entitlement = entitlements.iter().find(|i| {
+        let serde_json::Value::Object(o) = i else { return false };
+        let Some(serde_json::Value::Number(n)) = o.get("response-id") else { return false };
+        n.as_u64().expect("not u64") == id
+    }).expect("Entitlement response not found!");
+    Ok(serde_json::from_value(entitlement.clone())?)
+}
+
+#[derive(Deserialize, Serialize, Debug)]
+#[serde(rename_all = "kebab-case")]
+pub struct PhoneNumberResponse {
+    pub phone_number: String,
+    pub signature: String,
+}
+
+#[derive(Deserialize, Serialize, Debug)]
+pub struct EntitlementsResponse {
+    pub phone: PhoneNumberResponse,
+    pub host: String,
+}
+
+impl EntitlementAuthState {
+
+    pub fn new(subscriber: String, mccmnc: String, imei: String) -> Self {
+        Self {
+            device_account_identifier: Uuid::new_v4().to_string().to_uppercase(),
+            unique_id: imei,
+            subscriber,
+            mccmnc,
+            token: None,
+        }
+    }
+
+    pub async fn get_entitlements<Fut: Future<Output = Result<String, PushError>>>(&mut self, config: &dyn OSConfig, aps: &APSConnection, process_challenge: impl FnOnce(String) -> Fut) -> Result<EntitlementsResponse, PushError> {
+        let entitlements = get_gateways_for_mccmnc(&self.mccmnc).await?.carrier;
+
+        let mut starting_id = rand::thread_rng().gen_range(3..5);
+
+        let auth_challenge = if let Some(token) = &self.token {
+            json!({
+                "device-account-identifier": &self.device_account_identifier,
+                "auth-type": "EAP-AKA",
+                "action-name": "getAuthentication",
+                "subscriber-id": base64_encode(&[b"\x02\x00\x00;\x01", self.subscriber.as_bytes()].concat()),
+                "request-id": starting_id,
+                "unique-id": &self.unique_id,
+                "token": token,
+            })
+        } else {
+            let challenge = entitlements.invoke(&[
+                json!({
+                    "device-account-identifier": &self.device_account_identifier,
+                    "auth-type": "EAP-AKA",
+                    "action-name": "getAuthentication",
+                    "subscriber-id": base64_encode(&[b"\x02\x00\x00;\x01", self.subscriber.as_bytes()].concat()),
+                    "request-id": starting_id,
+                    "unique-id": &self.unique_id
+                })
+            ], config).await?;
+
+            #[derive(Deserialize)]
+            struct ChallengeResponse {
+                challenge: String,
+            }
+            let result: ChallengeResponse = find_entitlement_result(&challenge, starting_id)?;
+
+            let response = process_challenge(result.challenge).await?;
+
+            starting_id = rand::thread_rng().gen_range(10..13);
+
+            json!({
+                "payload": response,
+                "action-name": "postChallenge",
+                "request-id": starting_id,
+            })
+        };
+
+        let response = entitlements.invoke(&[
+            auth_challenge,
+            json!({
+                "client-nonce": base64_encode(&aps.get_token().await),
+                "action-name": "getPhoneNumber",
+                "request-id": starting_id + 1,
+            })
+        ], config).await?;
+
+        #[derive(Deserialize)]
+        #[serde(rename_all = "kebab-case")]
+        struct AuthResponse {
+            token: String,
+        }
+
+        let auth: AuthResponse = find_entitlement_result(&response, starting_id)?;
+        self.token = Some(auth.token);
+
+        let phone: PhoneNumberResponse = find_entitlement_result(&response, starting_id + 1)?;
+
+        Ok(EntitlementsResponse {
+            phone,
+            host: entitlements.server_address.clone()
+        })
+    }
+}
+
 
 
 pub trait Resource: Send + Sync + Sized {

Original file line number	Diff line number	Diff line change
`@@ -187,4 +187,6 @@ pub enum PushError {`
`187`	`187`	`MasterKeyNotFound,`
`188`	`188`	`#[error("Resource Stalled!")]`
`189`	`189`	`ResourceStalled,`
	`190`	`+ #[error("ICC Auth failed!")]`
	`191`	`+ ICCAuthFailed,`
`190`	`192`	`}`