一、背景 & 场景
1.1 环境
设备型号:iphone 14、iOS 版本:16.4.1、越狱方案:Dopamine
工具链：Frida16.1.4、IDA pro 9.2
1.2 引言
对于大多数互联网风控攻防业务来说，真正棘手的往往不是单个请求本身，而是背后那一整套“批量造设备、批量刷行为”的自动化体系。正是在这样的背景下，从最初的简单模拟请求，到如今的设备指纹伪造、群控刷量，攻防对抗从未停止。在这一背景下，Apple 推出的 DeviceCheck（以及后续的 App Attest）成为了 iOS 平台上反作弊与反爬虫的重要防线。
DeviceCheck 的核心目标是在保护用户隐私的前提下，为开发者提供一种持久化的设备标记能力。即使 App 被卸载重装，甚至设备被恢复出厂设置（在某些条件下），DeviceCheck 存储的 2-bit 状态依然可以被保留。这使得它成为了对抗“新用户薅羊毛”、“设备封禁”等场景的利器。
然而，对于安全研究人员和黑灰产从业者而言，DeviceCheck 也是一个必须攻克的堡垒。本文将基于逆向工程视角，简单剖析 DeviceCheck 的底层实现，揭示其加密流程，并探讨在越狱环境下进行攻防对抗的可行性。
1.3、研究动机与目标
-
验证通过改机（UniqueChipID / ECID/SerialNumber等）为什么不能激活设备？
-
想搞清楚：苹果到底在检验什么？哪些字段是“硬绑定”的？
-
从攻击与防护视角学习如何应用好DeviceCheck?
1.4、整体流程与框架
- 激活流程
- Device Token生成流程
二、mobileactivationd 激活流程分析
2.1、什么时候会激活？
这里说的激活，就是由 mobileactivationd + Apple 服务器 参与的那种“和苹果聊一聊，我是谁、能不能用”的流程，而不是普通 App 级别的登录。
首次开箱 / 刷机之后第一次开机
-
全新 iPhone、刚刷完原版 IPSW、DFU 恢复之后第一次进开机向导。
-
这时候本地没任何“激活凭据”，系统必须：
-
收集硬件指纹（ECID、ChipID、BoardId、SerialNumber…）
-
跟 Apple 服务器谈一轮，生成 / 刷新 uik.pem / ucrt.pem、设备证书等。
-
你能看到的表现就是：
- 屏幕上显示 “正在激活 iPhone，需要几分钟”
恢复出厂设置 / 抹掉所有内容之后
-
在设置 → 通用 → 传输或还原 iPhone → 抹掉所有内容和设置，或者用 Finder/iTunes 恢复。
-
抹掉后再次启动，和第一次开箱本质一样，也要重新激活。
-
这时 mobileactivationd 会：
-
检查旧的激活票据是否还有效
-
一般还是会重新向服务器请求新的激活证书（你抓到的 RKCertification 就是这类东西）。
硬件变化比较大时（换本板 / 基带 / 改机）
-
主板更换、严重“硬改机”、某些基带相关硬件变化，会导致：
-
UniqueChipID（ECID）、ChipID、BoardId、SecurityDomain 组合发生改变。
-
Apple 服务器视角：这是“另一台设备”，必须重新审查：
-
有没有被报失
-
有没有被运营商锁 / 黑名单
-
所以一旦检测到这种变化，系统会强制重新走激活流程。
-
你的 hook 里如果把 UniqueChipID 换成别的机器的 ECID，就会看到服务器直接回：
某些大版本升级 / 本地激活证书过期异常
和运营商 / 区域相关的情况
小结一句：
只要 Apple 觉得“我有理由重新确认你这台机器的身份/状态”，就会触发 mobileactivationd 跑激活。
2.2、为什么要激活？
从苹果的角度，这一整套“激活”设计，主要是为了解决三大问题：防伪造、防偷盗、统一发证。DeviceCheck / AppAttest 其实都是站在这套基础设施上实现的。
确认“这是一台真机，而不是山寨/模拟设备”
-
激活时上传的 RKCertification 里，包含：
-
从 Secure Enclave 拿到的真·硬件密钥的 attestation
-
ECID / ChipID / BoardId / SerialNumber / SecurityDomain 等指纹
-
苹果在服务器上用自己的 CA 体系校验证书链：
-
证书是不是 Apple 自己签出来的
-
硬件签名是不是由安全芯片里那把私钥算出来的
-
结论：
防丢失、防盗机、控制设备生命周期
激活是苹果“设备生命周期管理”的关键环节：
-
防盗 / 查找我的 iPhone：
-
被“查找”绑定过的机器，如果被抹掉再激活，Apple 会要求输入原 Apple ID 才能继续。
-
黑名单 / 封禁：
-
被判定为重大违规（盗刷、欺诈）的 ECID/序列号，可以在服务器侧直接标记，下一次激活就直接拒绝。
-
区域控制：
-
比如某些功能/频段只在特定地区开放，也可以通过激活阶段写入策略。
为上层安全服务“铺路”（你现在在玩的部分）
激活完成后，mobileactivationd 会产出一套“设备根身份”：
-
系统组文件：uik.pem / ucrt.pem
-
Keychain 里的：
-
这些东西后面会被谁用？
-
devicecheckd 生成 DeviceCheck Token
-
AppAttest 做应用级 attestation
-
各种安全相关 daemon（FairPlay、Apple Pay、Find My…）
2.3、激活流程逆向分析
主要通过copyAnswer:方法采集设备唯一性相关信息
UniqueChipID: "6871544955xxxxxx",
ChipID: "33040",
BoardId: "24",
SecurityDomain: "1",
SerialNumber: "F6X439xxxxxx",
BuildVersion: "20E252",
UniqueDeviceID: "00008110-303C30C91A0xxxxxx"
// 获取设备信息
void __fastcall create_baa_info_sub_1000EEDCC(__SecKey *a1, id a2, _QWORD *a3)
{
id v4; // x25
id v5; // x20
void *v6; // x21
id v7; // x20
int v8; // w5
int v9; // w6
int v10; // w7
id v11; // x19
NSArray *v12; // x21
void *v13; // x27
NSNumber *v14; // x0
int v15; // w5
int v16; // w6
int v17; // w7
NSNumber *v18; // x24
void *v19; // x22
id v20; // x23
void *v21; // x27
void *v22; // x22
char *v23; // x0
char *v24; // x23
__int64 v25; // x25
char *i; // x28
__SecKey *v27; // x24
int v28; // w5
int v29; // w6
int v30; // w7
const void *v31; // x9
void *v32; // x27
void *v33; // x26
void *v34; // x23
void *v35; // x19
_BOOL4 v36; // w9
__SecKey *v37; // x20
void *v38; // x23
_BOOL4 v39; // w24
_BOOL4 v40; // w19
NSNumber *v41; // x26
id v42; // x22
int v43; // w1
__SecKey *v44; // x21
int v45; // w5
int v46; // w6
int v47; // w7
id v48; // x20
__SecKey *v49; // x0
int v50; // w5
int v51; // w6
int v52; // w7
CFDataRef v53; // x21
int v54; // w5
int v55; // w6
int v56; // w7
__int64 v57; // x0
int v58; // w5
int v59; // w6
int v60; // w7
char v61; // w22
int v62; // w24
int v63; // w5
int v64; // w6
int v65; // w7
__SecKey *v66; // x19
int v67; // w5
int v68; // w6
int v69; // w7
unsigned int v70; // w28
void *v71; // x21
__SecKey *v72; // x22
int v73; // w5
int v74; // w6
int v75; // w7
int v76; // w5
int v77; // w6
int v78; // w7
id v79; // x19
int v80; // w5
int v81; // w6
int v82; // w7
void *v83; // x21
id v84; // x22
NSNumber *v85; // x25
NSNumber *v86; // x19
NSNumber *v87; // x21
unsigned __int8 v88; // w22
int v89; // w5
int v90; // w6
int v91; // w7
NSNumber *v92; // x19
unsigned int v93; // w20
int v94; // w5
int v95; // w6
int v96; // w7
const __CFString *v97; // x4
int v98; // w1
int v99; // w2
id v100; // x20
int v101; // w5
int v102; // w6
int v103; // w7
__SecKey *v104; // x0
int v105; // w5
int v106; // w6
int v107; // w7
NSFileManager *v108; // x20
NSFileManager *v109; // x21
void *v110; // x22
unsigned __int8 v111; // w23
int v112; // w5
int v113; // w6
int v114; // w7
id v115; // x20
id v116; // x20
int v117; // w5
int v118; // w6
int v119; // w7
id v120; // x20
void *v121; // x21
id v122; // x20
int v123; // w5
int v124; // w6
int v125; // w7
id v126; // x20
void *v127; // x21
id v128; // x20
int v129; // w5
int v130; // w6
int v131; // w7
id v132; // x20
__SecKey *v133; // x21
id v134; // x20
int v135; // w5
int v136; // w6
int v137; // w7
id v138; // x20
__SecKey *v139; // x21
id v140; // x20
int v141; // w5
int v142; // w6
int v143; // w7
id v144; // x21
void *v145; // x26
int v146; // w5
int v147; // w6
int v148; // w7
__SecKey *v149; // x0
int v150; // w5
int v151; // w6
int v152; // w7
CFDataRef v153; // x0
int v154; // w5
int v155; // w6
int v156; // w7
CFDataRef v157; // x24
int v158; // w1
id v159; // x26
id v160; // x21
int v161; // w5
int v162; // w6
int v163; // w7
__SecKey *v164; // x19
__CFString **v165; // x8
CFDataRef v166; // x26
CFDataRef v167; // x2
void *v168; // x20
id v169; // x21
void *v170; // x20
void *v171; // x21
void *v172; // x0
void *v173; // x23
int v174; // w5
int v175; // w6
int v176; // w7
void *v177; // x20
int v178; // w5
int v179; // w6
int v180; // w7
void *v181; // x20
void *v182; // x21
void *v183; // x0
void *v184; // x20
int v185; // w5
int v186; // w6
int v187; // w7
void *v188; // x20
int v189; // w5
int v190; // w6
int v191; // w7
void *v192; // x20
void *v193; // x21
void *v194; // x0
void *v195; // x20
int v196; // w5
int v197; // w6
int v198; // w7
int v199; // w5
int v200; // w6
int v201; // w7
int v202; // w5
int v203; // w6
int v204; // w7
__SecKey *v205; // x0
void *v206; // x20
id v207; // x21
void *v208; // x20
void *v209; // x21
id v210; // x22
void *v211; // x21
unsigned int v212; // w19
void *v213; // x22
id v214; // x23
void *v215; // x21
void *v216; // x22
id v217; // x23
void *v218; // x21
void *v219; // x22
id v220; // x23
void *v221; // x21
void *v222; // x22
id v223; // x23
void *v224; // x23
int v225; // w5
int v226; // w6
int v227; // w7
void *v228; // x22
id v229; // x23
__SecKey *v230; // x21
__SecKey *v231; // x24
void *v232; // x28
id v233; // x27
void *v234; // x25
void *v235; // x26
__SecKey *v236; // x23
void *v237; // x22
id v238; // x19
const void *v239; // x20
__SecKey *v240; // x21
__SecKey *v241; // x0
id v242; // x19
NSDictionary *v243; // x22
void *v244; // x24
__CFString **v245; // x8
void *v246; // x0
id v247; // x0
void *v248; // x22
char v249; // w23
id v250; // x19
id v251; // x23
int v252; // w5
int v253; // w6
int v254; // w7
id v255; // x19
id v256; // x24
int v257; // w5
int v258; // w6
int v259; // w7
char is_darwinos; // w0
id v261; // x19
id v262; // x21
int v263; // w5
int v264; // w6
int v265; // w7
id v266; // x24
NSData *v267; // x24
int v268; // w5
int v269; // w6
int v270; // w7
CFDataRef v271; // x2
int v272; // w5
int v273; // w6
int v274; // w7
char v275; // [xsp+0h] [xbp-3B0h]
char v276; // [xsp+0h] [xbp-3B0h]
void *v277; // [xsp+8h] [xbp-3A8h]
__SecKey *v278; // [xsp+18h] [xbp-398h]
__SecKey *v279; // [xsp+20h] [xbp-390h]
void *v280; // [xsp+28h] [xbp-388h]
void *v281; // [xsp+30h] [xbp-380h]
void *v282; // [xsp+38h] [xbp-378h]
__SecKey *v283; // [xsp+40h] [xbp-370h]
__SecKey *v284; // [xsp+48h] [xbp-368h]
__SecKey *cf; // [xsp+50h] [xbp-360h]
id v286; // [xsp+58h] [xbp-358h]
id v287; // [xsp+58h] [xbp-358h]
char v288[8]; // [xsp+60h] [xbp-350h]
__SecKey *v289; // [xsp+68h] [xbp-348h]
__SecKey *v290; // [xsp+70h] [xbp-340h]
const void *v291; // [xsp+78h] [xbp-338h]
id v292; // [xsp+80h] [xbp-330h]
id v293; // [xsp+80h] [xbp-330h]
__SecKey *v294; // [xsp+88h] [xbp-328h]
__SecKey *v295; // [xsp+88h] [xbp-328h]
CFDataRef v296; // [xsp+90h] [xbp-320h]
unsigned int v297; // [xsp+98h] [xbp-318h]
NSData *v298; // [xsp+98h] [xbp-318h]
CFDataRef v299; // [xsp+A0h] [xbp-310h]
id v300; // [xsp+A8h] [xbp-308h]
id v301; // [xsp+B0h] [xbp-300h]
id v302; // [xsp+B8h] [xbp-2F8h]
_BOOL4 v303; // [xsp+C0h] [xbp-2F0h]
_BOOL4 v304; // [xsp+C0h] [xbp-2F0h]
id v305; // [xsp+C0h] [xbp-2F0h]
id v306; // [xsp+C8h] [xbp-2E8h]
id v307; // [xsp+D0h] [xbp-2E0h]
NSNumber *v308; // [xsp+D8h] [xbp-2D8h]
NSNumber *v309; // [xsp+E0h] [xbp-2D0h]
id v310; // [xsp+E8h] [xbp-2C8h]
id v311; // [xsp+F0h] [xbp-2C0h]
id v312; // [xsp+F8h] [xbp-2B8h]
NSNumber *v313; // [xsp+100h] [xbp-2B0h]
id v314; // [xsp+108h] [xbp-2A8h]
id v315; // [xsp+110h] [xbp-2A0h]
__SecKey *v316; // [xsp+118h] [xbp-298h]
unsigned int v317; // [xsp+118h] [xbp-298h]
id v318; // [xsp+120h] [xbp-290h]
id v319; // [xsp+128h] [xbp-288h]
CFDataRef v320; // [xsp+130h] [xbp-280h]
id v321; // [xsp+138h] [xbp-278h]
NSNumber *v322; // [xsp+140h] [xbp-270h]
__SecKey *v323; // [xsp+148h] [xbp-268h]
id v324; // [xsp+148h] [xbp-268h]
id v325; // [xsp+148h] [xbp-268h]
id v327; // [xsp+158h] [xbp-258h] BYREF
id v328; // [xsp+160h] [xbp-250h] BYREF
id v329; // [xsp+168h] [xbp-248h] BYREF
id v330[2]; // [xsp+170h] [xbp-240h] BYREF
id v331; // [xsp+180h] [xbp-230h] BYREF
id v332; // [xsp+188h] [xbp-228h] BYREF
id v333; // [xsp+190h] [xbp-220h] BYREF
id v334[3]; // [xsp+198h] [xbp-218h] BYREF
id v335[2]; // [xsp+1B0h] [xbp-200h] BYREF
id v336[2]; // [xsp+1C0h] [xbp-1F0h]
id v337[2]; // [xsp+1D0h] [xbp-1E0h]
id v338[2]; // [xsp+1E0h] [xbp-1D0h]
CFErrorRef error; // [xsp+1F0h] [xbp-1C0h] BYREF
id v340[12]; // [xsp+1F8h] [xbp-1B8h] BYREF
_QWORD v341[12]; // [xsp+258h] [xbp-158h] BYREF
char v342[8]; // [xsp+2B8h] [xbp-F8h] BYREF
_QWORD v343[3]; // [xsp+338h] [xbp-78h] BYREF
__int64 vars8; // [xsp+3B8h] [xbp+8h]
v4 = objc_retain(a2);
error = 0;
v5 = objc_retainAutoreleasedReturnValue(+[GestaltHlpr getSharedInstance](&OBJC_CLASS___GestaltHlpr, "getSharedInstance"));
v6 = objc_msgSend(v5, "copyAnswer:", CFSTR("s7nuHoZIYNoOHCqT9iyZkQ"));
objc_release(v5);
v319 = v6;
v7 = objc_retainAutoreleasedReturnValue((id)isKindOfClass_0(v6));
objc_release(v7);
if ( !v7 )
{
v322 = 0;
v324 = objc_retainAutoreleasedReturnValue((id)com_apple_MobileActivation_ErrorDomain(
(int)"create_baa_info",
244,
-1,
0,
(int)CFSTR("Failed to retrieve %@."),
v8,
v9,
v10,
(char)CFSTR("s7nuHoZIYNoOHCqT9iyZkQ")));
v302 = 0;
v31 = 0;
v306 = 0;
v307 = 0;
v315 = 0;
v299 = 0;
v300 = 0;
v310 = 0;
v311 = 0;
v313 = 0;
v308 = 0;
v309 = 0;
v318 = 0;
v321 = 0;
v27 = 0;
a1 = 0;
v32 = 0;
v33 = 0;
v34 = 0;
v35 = 0;
LABEL_18:
v320 = 0;
v316 = 0;
LABEL_46:
v296 = 0;
v298 = 0;
v312 = 0;
v314 = 0;
v44 = 0;
LABEL_47:
v72 = 0;
v301 = 0;
v305 = 0;
goto LABEL_180;
}
v11 = objc_alloc((Class)&OBJC_CLASS___NSMutableArray);
v343[0] = CFSTR("1.2.840.113635.100.8.4");
v343[1] = CFSTR("1.2.840.113635.100.8.5");
v343[2] = CFSTR("1.2.840.113635.100.8.7");
v12 = objc_retainAutoreleasedReturnValue(+[NSArray arrayWithObjects:count:](&OBJC_CLASS___NSArray, "arrayWithObjects:count:", v343, 3));
v13 = objc_msgSend(v11, "initWithArray:", v12);
objc_release(v12);
v14 = objc_retainAutoreleasedReturnValue(+[NSNumber numberWithUnsignedInt:](&OBJC_CLASS___NSNumber, "numberWithUnsignedInt:", 0));
v322 = v14;
if ( !v4 )
{
v36 = 0;
v297 = 0;
v37 = 0;
v320 = 0;
v38 = 0;
v310 = 0;
v311 = 0;
v300 = 0;
v315 = 0;
v306 = 0;
v39 = 0;
v40 = 1;
v41 = (NSNumber *)&off_100E66CB8;
v308 = (NSNumber *)&off_100E66CB8;
v309 = (NSNumber *)&off_100E66CA0;
goto LABEL_20;
}
v18 = v14;
v323 = a1;
v19 = objc_retainAutoreleasedReturnValue(objc_msgSend(v4, "objectForKeyedSubscript:", CFSTR("OIDSToInclude")));
v20 = objc_retainAutoreleasedReturnValue((id)isKindOfClass());
objc_release(v20);
objc_release(v19);
if ( v20 )
{
v321 = v13;
*(_OWORD *)v337 = 0u;
*(_OWORD *)v338 = 0u;
*(_OWORD *)v335 = 0u;
*(_OWORD *)v336 = 0u;
v21 = v4;
v22 = objc_retainAutoreleasedReturnValue(objc_msgSend(v4, "objectForKeyedSubscript:", CFSTR("OIDSToInclude")));
v23 = (char *)objc_msgSend(v22, "countByEnumeratingWithState:objects:count:", v335, v342, 16);
if ( v23 )
{
v24 = v23;
v25 = *(_QWORD *)v336[0];
while ( 2 )
{
for ( i = 0; i != v24; ++i )
{
if ( *(_QWORD *)v336[0] != v25 )
objc_enumerationMutation(v22);
v27 = (__SecKey *)objc_retainAutoreleasedReturnValue((id)isKindOfClass_1(*((_QWORD *)v335[1] + (_QWORD)i)));
objc_release(v27);
if ( !v27 )
{
v4 = v21;
v277 = objc_retainAutoreleasedReturnValue(objc_msgSend(v21, "objectForKeyedSubscript:", CFSTR("OIDSToInclude")));
v324 = objc_retainAutoreleasedReturnValue((id)com_apple_MobileActivation_ErrorDomain(
(int)"create_baa_info",
263,
-2,
0,
(int)CFSTR("Invalid options (%@): %@"),
v76,
v77,
v78,
(char)CFSTR("OIDSToInclude")));
objc_release(v277);
objc_release(v22);
v302 = 0;
v31 = 0;
v306 = 0;
v307 = 0;
v315 = 0;
v300 = 0;
v310 = 0;
v311 = 0;
v318 = 0;
goto LABEL_93;
}
}
v24 = (char *)objc_msgSend(v22, "countByEnumeratingWithState:objects:count:", v335, v342, 16);
if ( v24 )
continue;
break;
}
}
objc_release(v22);
v4 = v21;
v13 = objc_retainAutoreleasedReturnValue(objc_msgSend(v21, "objectForKeyedSubscript:", CFSTR("OIDSToInclude")));
objc_release(v321);
v18 = v322;
}
v321 = v13;
if ( (unsigned int)objc_msgSend(v13, "containsObject:", CFSTR("1.2.840.113635.100.8.1"))
&& ((sub_100C87320() & 1) != 0 || (unsigned int)sub_100C87330()) )
{
v324 = objc_retainAutoreleasedReturnValue((id)com_apple_MobileActivation_ErrorDomain(
(int)"create_baa_info",
276,
-2,
0,
(int)CFSTR("Boot manifest not available in rOS or diagnosticsOS."),
v28,
v29,
v30,
v275));
v302 = 0;
v31 = 0;
v306 = 0;
v315 = 0;
v300 = 0;
v310 = 0;
v311 = 0;
v318 = 0;
goto LABEL_92;
}
v304 = ((unsigned int)objc_msgSend(v13, "containsObject:", CFSTR("1.2.840.113635.100.8.1")) & 1) != 0
|| ((unsigned int)objc_msgSend(v13, "containsObject:", CFSTR("1.2.840.113635.100.8.7")) & 1) != 0
|| ((unsigned int)objc_msgSend(v13, "containsObject:", CFSTR("1.2.840.113635.100.8.10.1")) & 1) != 0
|| ((unsigned int)objc_msgSend(v13, "containsObject:", CFSTR("1.2.840.113635.100.8.10.2")) & 1) != 0
|| (unsigned int)objc_msgSend(v13, "containsObject:", CFSTR("1.2.840.113635.100.8.10.3"));
v70 = (unsigned int)objc_msgSend(v13, "containsObject:", CFSTR("1.2.840.113635.100.8.7"));
if ( ((unsigned int)objc_msgSend(v13, "containsObject:", CFSTR("1.2.840.113635.100.8.2")) & 1) != 0
|| (unsigned int)objc_msgSend(v13, "containsObject:", CFSTR("1.2.840.113635.100.8.11.1")) )
{
v71 = objc_retainAutoreleasedReturnValue(objc_msgSend(v4, "objectForKeyedSubscript:", CFSTR("nonce")));
v72 = (__SecKey *)objc_retainAutoreleasedReturnValue((id)isKindOfClass_2());
objc_release(v72);
objc_release(v71);
if ( !v72 )
{
v324 = objc_retainAutoreleasedReturnValue((id)com_apple_MobileActivation_ErrorDomain(
(int)"create_baa_info",
295,
-2,
0,
(int)CFSTR("Missing required option: %@"),
v73,
v74,
v75,
(char)CFSTR("nonce")));
v302 = 0;
v31 = 0;
v306 = 0;
v307 = 0;
v315 = 0;
v316 = 0;
v299 = 0;
v300 = 0;
v310 = 0;
v311 = 0;
v318 = 0;
v27 = 0;
a1 = 0;
v32 = 0;
v33 = 0;
v34 = 0;
v35 = 0;
v7 = 0;
v320 = 0;
v296 = 0;
v298 = 0;
v312 = 0;
v314 = 0;
v44 = 0;
LABEL_96:
v301 = 0;
v305 = 0;
v313 = (NSNumber *)&off_100E66CB8;
v308 = (NSNumber *)&off_100E66CB8;
v309 = (NSNumber *)&off_100E66CA0;
goto LABEL_180;
}
v318 = objc_retainAutoreleasedReturnValue(objc_msgSend(v4, "objectForKeyedSubscript:", CFSTR("nonce")));
}
else
{
v318 = 0;
}
v83 = objc_retainAutoreleasedReturnValue(objc_msgSend(v4, "objectForKeyedSubscript:", CFSTR("CertType")));
v84 = objc_retainAutoreleasedReturnValue((id)isKindOfClass_0(v83));
objc_release(v84);
objc_release(v83);
v293 = v4;
if ( v84 )
{
v85 = objc_retainAutoreleasedReturnValue(objc_msgSend(v4, "objectForKeyedSubscript:", CFSTR("CertType")));
objc_release(v18);
v86 = objc_retainAutoreleasedReturnValue(+[NSNumber numberWithUnsignedInt:](&OBJC_CLASS___NSNumber, "numberWithUnsignedInt:", 0));
if ( -[NSNumber isEqualToNumber:](v85, "isEqualToNumber:", v86) )
{
objc_release(v86);
v18 = v85;
}
else
{
v87 = objc_retainAutoreleasedReturnValue(+[NSNumber numberWithUnsignedInt:](&OBJC_CLASS___NSNumber, "numberWithUnsignedInt:", 1));
v88 = -[NSNumber isEqualToNumber:](v85, "isEqualToNumber:", v87);
objc_release(v87);
objc_release(v86);
v18 = v85;
if ( (v88 & 1) == 0 )
{
v324 = objc_retainAutoreleasedReturnValue((id)com_apple_MobileActivation_ErrorDomain(
(int)"create_baa_info",
306,
-2,
0,
(int)CFSTR("Invalid value for option (%@): %@"),
v89,
v90,
v91,
(char)CFSTR("CertType")));
v302 = 0;
v31 = 0;
v306 = 0;
v307 = 0;
v315 = 0;
v316 = 0;
v299 = 0;
v300 = 0;
v310 = 0;
v311 = 0;
v27 = 0;
a1 = 0;
v32 = 0;
v33 = 0;
v34 = 0;
v35 = 0;
v7 = 0;
v320 = 0;
v296 = 0;
v298 = 0;
v314 = 0;
v44 = 0;
v72 = 0;
v301 = 0;
v305 = 0;
v322 = v85;
v312 = 0;
v313 = (NSNumber *)&off_100E66CB8;
v308 = (NSNumber *)&off_100E66CB8;
v309 = (NSNumber *)&off_100E66CA0;
v4 = v293;
goto LABEL_180;
}
}
}
v92 = objc_retainAutoreleasedReturnValue(+[NSNumber numberWithUnsignedInt:](&OBJC_CLASS___NSNumber, "numberWithUnsignedInt:", 1));
v93 = -[NSNumber isEqualToNumber:](v18, "isEqualToNumber:", v92);
objc_release(v92);
v322 = v18;
if ( v93 )
{
v4 = v293;
if ( ((unsigned int)objc_msgSend(v319, "boolValue") & 1) == 0 )
{
v97 = CFSTR("Certificate type not supported on this platform: %@");
v276 = (char)v18;
v98 = 313;
v99 = -3;
goto LABEL_89;
}
if ( ((unsigned int)objc_msgSend(v13, "containsObject:", CFSTR("1.2.840.113635.100.6.71.1")) & 1) == 0 )
{
v97 = CFSTR("Missing required OID for certificate type (%@): %@");
v276 = (char)v18;
v98 = 318;
LABEL_66:
v99 = -2;
LABEL_89:
v324 = objc_retainAutoreleasedReturnValue((id)com_apple_MobileActivation_ErrorDomain(
(int)"create_baa_info",
v98,
v99,
0,
(int)v97,
v94,
v95,
v96,
v276));
LABEL_90:
v302 = 0;
v31 = 0;
v306 = 0;
v315 = 0;
v300 = 0;
v311 = 0;
LABEL_91:
v310 = 0;
LABEL_92:
v307 = 0;
v27 = 0;
LABEL_93:
a1 = 0;
v32 = 0;
v33 = 0;
v34 = 0;
v299 = 0;
v35 = 0;
goto LABEL_94;
}
}
else
{
v4 = v293;
if ( ((unsigned int)objc_msgSend(v13, "containsObject:", CFSTR("1.2.840.113635.100.6.71.1")) & 1) != 0
|| ((unsigned int)objc_msgSend(v13, "containsObject:", CFSTR("1.2.840.113635.100.6.71.2")) & 1) != 0
|| (unsigned int)objc_msgSend(v13, "containsObject:", CFSTR("1.2.840.113635.100.6.71.3")) )
{
v97 = CFSTR("Invalid OID(s) for requested certificate type: %@");
v276 = (char)v18;
v98 = 325;
goto LABEL_66;
}
}
if ( (unsigned int)objc_msgSend(v13, "containsObject:", CFSTR("1.2.840.113635.100.6.71.1"))
&& (v168 = objc_retainAutoreleasedReturnValue(objc_msgSend(v4, "objectForKeyedSubscript:", CFSTR("MFiProperties"))),
v169 = objc_retainAutoreleasedReturnValue((id)isKindOfClass_2()),
objc_release(v169),
objc_release(v168),
v169) )
{
v170 = objc_retainAutoreleasedReturnValue(objc_msgSend(v4, "objectForKeyedSubscript:", CFSTR("MFiProperties")));
v171 = objc_msgSend(v170, "length");
objc_release(v170);
v172 = objc_retainAutoreleasedReturnValue(objc_msgSend(v4, "objectForKeyedSubscript:", CFSTR("MFiProperties")));
v173 = v172;
if ( v171 != (void *)32 )
{
objc_msgSend(v172, "length");
v324 = objc_retainAutoreleasedReturnValue((id)com_apple_MobileActivation_ErrorDomain(
(int)"create_baa_info",
333,
-2,
0,
(int)CFSTR("Invalid value for option (%@): unexpected size (%lu)"),
v174,
v175,
v176,
(char)CFSTR("MFiProperties")));
objc_release(v173);
goto LABEL_90;
}
}
else
{
v173 = 0;
}
v311 = v173;
if ( (unsigned int)objc_msgSend(v13, "containsObject:", CFSTR("1.2.840.113635.100.6.71.2")) )
{
v177 = objc_retainAutoreleasedReturnValue(objc_msgSend(v4, "objectForKeyedSubscript:", CFSTR("MFiPPUID")));
v44 = (__SecKey *)objc_retainAutoreleasedReturnValue((id)isKindOfClass_1(v177));
objc_release(v44);
objc_release(v177);
if ( !v44 )
{
v324 = objc_retainAutoreleasedReturnValue((id)com_apple_MobileActivation_ErrorDomain(
(int)"create_baa_info",
343,
-2,
0,
(int)CFSTR("Missing required option: %@"),
v178,
v179,
v180,
(char)CFSTR("MFiPPUID")));
v302 = 0;
v31 = 0;
v306 = 0;
v315 = 0;
v300 = 0;
LABEL_135:
v310 = 0;
v307 = 0;
v27 = 0;
a1 = 0;
v32 = 0;
v33 = 0;
v34 = 0;
v298 = 0;
v299 = 0;
v35 = 0;
v7 = 0;
v320 = 0;
v316 = 0;
v296 = 0;
v312 = 0;
v314 = 0;
goto LABEL_95;
}
v181 = objc_retainAutoreleasedReturnValue(objc_msgSend(v4, "objectForKeyedSubscript:", CFSTR("MFiPPUID")));
v182 = objc_msgSend(v181, "length");
objc_release(v181);
v183 = objc_retainAutoreleasedReturnValue(objc_msgSend(v4, "objectForKeyedSubscript:", CFSTR("MFiPPUID")));
v184 = v183;
if ( (unsigned __int64)v182 >= 0x25 )
{
objc_msgSend(v183, "length");
v324 = objc_retainAutoreleasedReturnValue((id)com_apple_MobileActivation_ErrorDomain(
(int)"create_baa_info",
348,
-2,
0,
(int)CFSTR("Invalid value for option (%@): unexpected size (%lu)"),
v185,
v186,
v187,
(char)CFSTR("MFiPPUID")));
objc_release(v184);
v302 = 0;
v31 = 0;
v306 = 0;
v315 = 0;
v300 = 0;
goto LABEL_91;
}
v35 = objc_retainAutoreleasedReturnValue(objc_msgSend(v183, "stringByPaddingToLength:withString:startingAtIndex:", 36, &stru_100E61E50, 0));
objc_release(v184);
if ( !v35 )
{
v324 = objc_retainAutoreleasedReturnValue((id)com_apple_MobileActivation_ErrorDomain(
(int)"create_baa_info",
357,
-2,
0,
(int)CFSTR("Failed to pad string."),
v199,
v200,
v201,
v275));
v302 = 0;
v31 = 0;
v306 = 0;
v307 = 0;
v315 = 0;
v299 = 0;
v300 = 0;
v310 = 0;
v27 = 0;
a1 = 0;
v32 = 0;
v33 = 0;
v34 = 0;
LABEL_94:
v7 = 0;
v320 = 0;
v316 = 0;
v296 = 0;
v298 = 0;
v312 = 0;
v314 = 0;
v44 = 0;
LABEL_95:
v72 = 0;
goto LABEL_96;
}
v315 = objc_retainAutoreleasedReturnValue(objc_msgSend(v35, "dataUsingEncoding:", 4));
if ( !v315 )
{
v300 = v35;
v324 = objc_retainAutoreleasedReturnValue((id)com_apple_MobileActivation_ErrorDomain(
(int)"create_baa_info",
363,
-2,
0,
(int)CFSTR("Failed to convert string to data."),
v202,
v203,
v204,
v275));
v302 = 0;
v31 = 0;
v306 = 0;
v315 = 0;
goto LABEL_91;
}
}
else
{
v35 = 0;
v315 = 0;
}
v300 = v35;
if ( !(unsigned int)objc_msgSend(v13, "containsObject:", CFSTR("1.2.840.113635.100.6.71.3")) )
{
v306 = 0;
goto LABEL_137;
}
v188 = objc_retainAutoreleasedReturnValue(objc_msgSend(v4, "objectForKeyedSubscript:", CFSTR("MFiData")));
v44 = (__SecKey *)objc_retainAutoreleasedReturnValue((id)isKindOfClass_2());
objc_release(v44);
objc_release(v188);
if ( !v44 )
{
v324 = objc_retainAutoreleasedReturnValue((id)com_apple_MobileActivation_ErrorDomain(
(int)"create_baa_info",
370,
-2,
0,
(int)CFSTR("Missing required option: %@"),
v189,
v190,
v191,
(char)CFSTR("MFiData")));
v302 = 0;
v31 = 0;
v306 = 0;
goto LABEL_135;
}
v192 = objc_retainAutoreleasedReturnValue(objc_msgSend(v4, "objectForKeyedSubscript:", CFSTR("MFiData")));
v193 = objc_msgSend(v192, "length");
objc_release(v192);
v194 = objc_retainAutoreleasedReturnValue(objc_msgSend(v4, "objectForKeyedSubscript:", CFSTR("MFiData")));
v195 = v194;
if ( (unsigned __int64)v193 >= 0x4B0 )
{
objc_msgSend(v194, "length");
v324 = objc_retainAutoreleasedReturnValue((id)com_apple_MobileActivation_ErrorDomain(
(int)"create_baa_info",
375,
-2,
0,
(int)CFSTR("Invalid value for option (%@): unexpected size (%lu)"),
v196,
v197,
v198,
(char)CFSTR("MFiData")));
objc_release(v195);
v302 = 0;
v31 = 0;
v306 = 0;
goto LABEL_91;
}
v306 = v194;
LABEL_137:
v206 = objc_retainAutoreleasedReturnValue(objc_msgSend(v4, "objectForKeyedSubscript:", CFSTR("UseRKSigningInterface")));
v207 = objc_retainAutoreleasedReturnValue((id)isKindOfClass_0(v206));
objc_release(v207);
objc_release(v206);
if ( v207 )
{
v208 = objc_retainAutoreleasedReturnValue(objc_msgSend(v4, "objectForKeyedSubscript:", CFSTR("UseRKSigningInterface")));
v317 = (unsigned int)objc_msgSend(v208, "boolValue");
objc_release(v208);
}
else
{
v317 = 0;
}
v209 = objc_retainAutoreleasedReturnValue(objc_msgSend(v4, "objectForKeyedSubscript:", CFSTR("UseSoftwareGeneratedKey")));
v210 = objc_retainAutoreleasedReturnValue((id)isKindOfClass_0(v209));
objc_release(v210);
objc_release(v209);
if ( v210 )
{
v211 = objc_retainAutoreleasedReturnValue(objc_msgSend(v4, "objectForKeyedSubscript:", CFSTR("UseSoftwareGeneratedKey")));
v212 = (unsigned int)objc_msgSend(v211, "boolValue");
objc_release(v211);
}
else
{
v212 = 1;
}
v213 = objc_retainAutoreleasedReturnValue(objc_msgSend(v4, "objectForKeyedSubscript:", CFSTR("Validity")));
v214 = objc_retainAutoreleasedReturnValue((id)isKindOfClass_0(v213));
objc_release(v214);
objc_release(v213);
if ( v214 )
{
v215 = objc_retainAutoreleasedReturnValue(objc_msgSend(v4, "objectForKeyedSubscript:", CFSTR("Validity")));
v309 = objc_retainAutoreleasedReturnValue(
+[NSNumber numberWithUnsignedInteger:](
&OBJC_CLASS___NSNumber,
"numberWithUnsignedInteger:",
objc_msgSend(v215, "unsignedIntegerValue")));
objc_release(v215);
}
else
{
v309 = (NSNumber *)&off_100E66CA0;
}
v216 = objc_retainAutoreleasedReturnValue(objc_msgSend(v4, "objectForKeyedSubscript:", CFSTR("CACert")));
v217 = objc_retainAutoreleasedReturnValue((id)isKindOfClass_0(v216));
objc_release(v217);
objc_release(v216);
if ( v217 )
{
v218 = objc_retainAutoreleasedReturnValue(objc_msgSend(v4, "objectForKeyedSubscript:", CFSTR("CACert")));
v308 = objc_retainAutoreleasedReturnValue(
+[NSNumber numberWithUnsignedInteger:](
&OBJC_CLASS___NSNumber,
"numberWithUnsignedInteger:",
objc_msgSend(v218, "unsignedIntegerValue")));
objc_release(v218);
}
else
{
v308 = (NSNumber *)&off_100E66CB8;
}
v219 = objc_retainAutoreleasedReturnValue(objc_msgSend(v4, "objectForKeyedSubscript:", CFSTR("scrtAttestation")));
v220 = objc_retainAutoreleasedReturnValue((id)isKindOfClass_0(v219));
objc_release(v220);
objc_release(v219);
if ( v220 )
{
v221 = objc_retainAutoreleasedReturnValue(objc_msgSend(v4, "objectForKeyedSubscript:", CFSTR("scrtAttestation")));
v41 = objc_retainAutoreleasedReturnValue(
+[NSNumber numberWithUnsignedInteger:](
&OBJC_CLASS___NSNumber,
"numberWithUnsignedInteger:",
objc_msgSend(v221, "unsignedIntegerValue")));
objc_release(v221);
}
else
{
v41 = (NSNumber *)&off_100E66CB8;
}
v222 = objc_retainAutoreleasedReturnValue(objc_msgSend(v4, "objectForKeyedSubscript:", CFSTR("ClientAttestationData")));
v223 = objc_retainAutoreleasedReturnValue((id)isKindOfClass_2());
objc_release(v223);
objc_release(v222);
if ( !v223 )
{
v37 = 0;
v320 = 0;
goto LABEL_156;
}
v224 = objc_retainAutoreleasedReturnValue(objc_msgSend(v4, "objectForKeyedSubscript:", CFSTR("ClientAttestationPublicKey")));
v27 = (__SecKey *)objc_retainAutoreleasedReturnValue((id)isKindOfClass_2());
objc_release(v27);
objc_release(v224);
if ( !v27 )
{
v313 = v41;
v324 = objc_retainAutoreleasedReturnValue((id)com_apple_MobileActivation_ErrorDomain(
(int)"create_baa_info",
412,
-2,
0,
(int)CFSTR("Missing required option for %@."),
v225,
v226,
v227,
(char)CFSTR("ClientAttestationPublicKey")));
v302 = 0;
v31 = 0;
v310 = 0;
v307 = 0;
a1 = 0;
v32 = 0;
v33 = 0;
v34 = 0;
v299 = 0;
v35 = 0;
v7 = 0;
goto LABEL_18;
}
v37 = objc_retainAutoreleasedReturnValue(objc_msgSend(v4, "objectForKeyedSubscript:", CFSTR("ClientAttestationData")));
v320 = objc_retainAutoreleasedReturnValue(objc_msgSend(v4, "objectForKeyedSubscript:", CFSTR("ClientAttestationPublicKey")));
LABEL_156:
v297 = v70;
v228 = objc_retainAutoreleasedReturnValue(objc_msgSend(v4, "objectForKeyedSubscript:", CFSTR("AppID")));
v229 = objc_retainAutoreleasedReturnValue((id)isKindOfClass_1(v228));
objc_release(v229);
objc_release(v228);
v39 = v317 != 0;
v40 = v212 != 0;
if ( v229 )
v310 = objc_retainAutoreleasedReturnValue(objc_msgSend(v4, "objectForKeyedSubscript:", CFSTR("AppID")));
else
v310 = 0;
v38 = v318;
a1 = v323;
v36 = v304;
LABEL_20:
v321 = v13;
v318 = v38;
v313 = v41;
if ( !a1 )
{
v316 = v37;
v324 = objc_retainAutoreleasedReturnValue((id)com_apple_MobileActivation_ErrorDomain(
(int)"create_baa_info",
467,
-2,
0,
(int)CFSTR("Invalid input."),
v15,
v16,
v17,
v275));
v302 = 0;
v31 = 0;
v307 = 0;
v27 = 0;
LABEL_45:
v32 = 0;
v33 = 0;
v34 = 0;
v299 = 0;
v35 = 0;
v7 = 0;
goto LABEL_46;
}
v42 = 0;
v303 = v36;
if ( !v39 || v37 )
{
v291 = 0;
v289 = 0;
v294 = 0;
LABEL_49:
v316 = v37;
v333 = v42;
v334[0] = 0;
v27 = security_copy_system_key(0, v334, &v333);
v7 = objc_retain(v334[0]);
v79 = objc_retain(v333);
objc_release(v42);
if ( !v27 )
{
v324 = objc_retainAutoreleasedReturnValue((id)com_apple_MobileActivation_ErrorDomain(
(int)"create_baa_info",
519,
-1,
error,
(int)CFSTR("Failed to copy SIK attestation key."),
v80,
v81,
v82,
v275));
objc_release(v79);
v302 = 0;
v305 = 0;
v301 = 0;
v72 = 0;
v44 = 0;
v314 = 0;
v296 = 0;
v298 = 0;
v312 = 0;
v35 = 0;
v299 = 0;
v34 = 0;
v33 = 0;
v32 = 0;
a1 = 0;
v307 = 0;
v290 = 0;
goto LABEL_173;
}
*(_QWORD *)v288 = v7;
if ( -[NSNumber boolValue](v41, "boolValue") )
{
v292 = v4;
v286 = 0;
v284 = 0;
}
else
{
v331 = v79;
v332 = 0;
v72 = security_copy_system_key(2, &v332, &v331);
v286 = objc_retain(v332);
v100 = objc_retain(v331);
objc_release(v79);
if ( !v72 )
{
v324 = objc_retainAutoreleasedReturnValue((id)com_apple_MobileActivation_ErrorDomain(
(int)"create_baa_info",
528,
-1,
v100,
(int)CFSTR("Failed to copy UIK attestation key."),
v101,
v102,
v103,
v275));
objc_release(v100);
CFRelease(v27);
v302 = 0;
v305 = 0;
v301 = 0;
v44 = 0;
v314 = 0;
v296 = 0;
v298 = 0;
v312 = 0;
v299 = 0;
v34 = 0;
v33 = 0;
v32 = 0;
a1 = 0;
v27 = 0;
v307 = 0;
v290 = 0;
v35 = v286;
v7 = *(id *)v288;
goto LABEL_173;
}
v284 = v72;
v292 = v4;
v79 = v100;
v7 = *(id *)v288;
}
cf = v27;
v104 = (__SecKey *)objc_alloc_init((Class)&OBJC_CLASS___NSMutableDictionary);
v72 = v104;
if ( !v104 )
{
v324 = objc_retainAutoreleasedReturnValue((id)com_apple_MobileActivation_ErrorDomain(
(int)"create_baa_info",
536,
-1,
0,
(int)CFSTR("Failed to allocate dictionary."),
v105,
v106,
v107,
v275));
objc_release(v79);
v302 = 0;
v305 = 0;
v301 = 0;
v44 = 0;
v314 = 0;
v296 = 0;
v298 = 0;
v312 = 0;
v299 = 0;
v34 = 0;
v33 = 0;
v32 = 0;
a1 = 0;
v27 = 0;
v307 = 0;
v290 = 0;
v4 = v292;
v35 = v286;
goto LABEL_171;
}
v283 = v104;
if ( -[NSNumber boolValue](v41, "boolValue")
|| (v108 = objc_retainAutoreleasedReturnValue(+[NSFileManager defaultManager](&OBJC_CLASS___NSFileManager, "defaultManager")),
v109 = objc_retainAutoreleasedReturnValue(objc_retainAutoreleaseReturnValue(v108)),
v110 = objc_retainAutoreleasedReturnValue(
-[NSFileManager stringByAppendingPathComponent:](
v109,
"stringByAppendingPathComponent:",
CFSTR("ucrt.pem"))),
v111 = -[NSFileManager fileExistsAtPath:](v108, "fileExistsAtPath:", v110),
objc_release(v110),
objc_release(v109),
objc_release(v108),
(v111 & 1) != 0) )
{
v115 = objc_retainAutoreleasedReturnValue(+[GestaltHlpr getSharedInstance](&OBJC_CLASS___GestaltHlpr, "getSharedInstance"));
v34 = objc_msgSend(v115, "copyAnswer:", CFSTR("UniqueChipID"));
objc_release(v115);
v116 = objc_retainAutoreleasedReturnValue((id)isKindOfClass_0(v34));
objc_release(v116);
if ( v116 )
{
v281 = v34;
v120 = objc_retainAutoreleasedReturnValue(+[GestaltHlpr getSharedInstance](&OBJC_CLASS___GestaltHlpr, "getSharedInstance"));
v121 = objc_msgSend(v120, "copyAnswer:", CFSTR("ChipID"));
objc_release(v120);
v282 = v121;
v122 = objc_retainAutoreleasedReturnValue((id)isKindOfClass_0(v121));
objc_release(v122);
if ( !v122 )
{
v324 = objc_retainAutoreleasedReturnValue((id)com_apple_MobileActivation_ErrorDomain(
(int)"create_baa_info",
588,
-1,
0,
(int)CFSTR("Failed to retrieve %@."),
v123,
v124,
v125,
(char)CFSTR("ChipID")));
objc_release(v79);
v302 = 0;
v305 = 0;
v301 = 0;
v44 = 0;
v314 = 0;
v296 = 0;
v298 = 0;
v312 = 0;
v299 = 0;
v32 = 0;
a1 = 0;
v27 = 0;
v307 = 0;
v290 = 0;
v4 = v292;
v35 = v286;
v7 = *(id *)v288;
v33 = v282;
v72 = v283;
goto LABEL_171;
}
v126 = objc_retainAutoreleasedReturnValue(+[GestaltHlpr getSharedInstance](&OBJC_CLASS___GestaltHlpr, "getSharedInstance"));
v127 = objc_msgSend(v126, "copyAnswer:", CFSTR("BoardId"));
objc_release(v126);
v280 = v127;
v128 = objc_retainAutoreleasedReturnValue((id)isKindOfClass_0(v127));
objc_release(v128);
if ( !v128 )
{
v324 = objc_retainAutoreleasedReturnValue((id)com_apple_MobileActivation_ErrorDomain(
(int)"create_baa_info",
594,
-1,
0,
(int)CFSTR("Failed to retrieve %@."),
v129,
v130,
v131,
(char)CFSTR("BoardId")));
objc_release(v79);
v302 = 0;
v305 = 0;
v301 = 0;
v44 = 0;
v314 = 0;
v296 = 0;
v298 = 0;
v312 = 0;
v299 = 0;
a1 = 0;
v27 = 0;
v307 = 0;
v290 = 0;
v4 = v292;
v35 = v286;
v7 = *(id *)v288;
v33 = v282;
v72 = v283;
v32 = v280;
goto LABEL_171;
}
v132 = objc_retainAutoreleasedReturnValue(+[GestaltHlpr getSharedInstance](&OBJC_CLASS___GestaltHlpr, "getSharedInstance"));
v133 = (__SecKey *)objc_msgSend(v132, "copyAnswer:", CFSTR("SecurityDomain"));
objc_release(v132);
v279 = v133;
v134 = objc_retainAutoreleasedReturnValue((id)isKindOfClass_0(v133));
objc_release(v134);
if ( !v134 )
{
v324 = objc_retainAutoreleasedReturnValue((id)com_apple_MobileActivation_ErrorDomain(
(int)"create_baa_info",
600,
-1,
0,
(int)CFSTR("Failed to retrieve %@."),
v135,
v136,
v137,
(char)CFSTR("SecurityDomain")));
objc_release(v79);
v302 = 0;
v305 = 0;
v301 = 0;
v44 = 0;
v314 = 0;
v296 = 0;
v298 = 0;
v312 = 0;
v299 = 0;
v27 = 0;
v307 = 0;
v290 = 0;
v4 = v292;
v35 = v286;
v7 = *(id *)v288;
v33 = v282;
v72 = v283;
v32 = v280;
LABEL_133:
a1 = v279;
goto LABEL_171;
}
v138 = objc_retainAutoreleasedReturnValue(+[GestaltHlpr getSharedInstance](&OBJC_CLASS___GestaltHlpr, "getSharedInstance"));
v139 = (__SecKey *)objc_msgSend(v138, "copyAnswer:", CFSTR("SerialNumber"));
objc_release(v138);
v278 = v139;
v140 = objc_retainAutoreleasedReturnValue((id)isKindOfClass_1(v139));
objc_release(v140);
if ( v140 )
{
v144 = objc_retainAutoreleasedReturnValue(+[GestaltHlpr getSharedInstance](&OBJC_CLASS___GestaltHlpr, "getSharedInstance"));
v145 = objc_msgSend(v144, "copyAnswer:", CFSTR("BuildVersion"));
objc_release(v144);
v307 = v145;
v44 = (__SecKey *)objc_retainAutoreleasedReturnValue((id)isKindOfClass_1(v145));
objc_release(v44);
if ( v44 )
{
v149 = SecKeyCopyPublicKey(a1);
if ( v149 )
{
v290 = v149;
v153 = SecKeyCopyExternalRepresentation(v149, &error);
v7 = *(id *)v288;
if ( v153 )
{
v157 = v153;
if ( -[NSNumber boolValue](v313, "boolValue") )
v158 = 0;
else
v158 = 2;
v330[1] = v79;
v159 = objc_retainAutoreleasedReturnValue((id)security_create_system_key_attestation(
(int)a1,
v158,
v318));
v160 = objc_retain(v79);
objc_release(v79);
v312 = v159;
v299 = v157;
if ( v159 )
{
v325 = v160;
if ( v316 )
{
v164 = v283;
-[__SecKey setObject:forKeyedSubscript:](
v283,
"setObject:forKeyedSubscript:",
v316,
CFSTR("RKCertification"));
-[__SecKey setObject:forKeyedSubscript:](
v283,
"setObject:forKeyedSubscript:",
v159,
CFSTR("RKSigning"));
v165 = off_100E52138;
v166 = v157;
v167 = v157;
}
else
{
v165 = off_100E51E10;
v167 = (CFDataRef)v159;
v164 = v283;
v166 = v157;
}
-[__SecKey setObject:forKeyedSubscript:](v164, "setObject:forKeyedSubscript:", v167, *v165);
v242 = objc_alloc((Class)&OBJC_CLASS___NSMutableDictionary);
v340[0] = CFSTR("UniqueChipID");
v340[1] = CFSTR("ChipID");
v341[0] = v34;
v341[1] = v282;
v340[2] = CFSTR("BoardId");
v340[3] = CFSTR("SecurityDomain");
v341[2] = v280;
v341[3] = v279;
v340[4] = CFSTR("SerialNumber");
v340[5] = CFSTR("OsBuildVersion");
v341[4] = v278;
v341[5] = v307;
v340[6] = CFSTR("scrtAttestation");
v340[7] = CFSTR("CertType");
v341[6] = v313;
v341[7] = v322;
v340[8] = CFSTR("Validity");
v340[9] = CFSTR("CACert");
v341[8] = v309;
v341[9] = v308;
v340[10] = CFSTR("OIDSToInclude");
v340[11] = CFSTR("SIKPub");
v341[10] = v13;
v341[11] = *(_QWORD *)v288;
v243 = objc_retainAutoreleasedReturnValue(
+[NSDictionary dictionaryWithObjects:forKeys:count:](
&OBJC_CLASS___NSDictionary,
"dictionaryWithObjects:forKeys:count:",
v341,
v340,
12));
v244 = objc_msgSend(v242, "initWithDictionary:", v243);
objc_release(v243);
v245 = off_100E52130;
if ( v316 )
{
objc_msgSend(v244, "setObject:forKeyedSubscript:", v320, CFSTR("RKCertificationPub"));
v245 = off_100E52138;
}
v35 = v286;
v246 = objc_msgSend(v244, "setObject:forKeyedSubscript:", v166, *v245);
if ( v286 )
v246 = objc_msgSend(v244, "setObject:forKeyedSubscript:", v286, CFSTR("UIKPub"));
v247 = objc_retainAutoreleasedReturnValue((id)IORegistryEntry_sub_10052290C(v246));
v314 = v244;
if ( !v247 )
goto LABEL_201;
v248 = v247;
if ( (sub_100C87330() & 1) != 0 )
{
objc_release(v248);
LABEL_201:
v302 = 0;
LABEL_207:
if ( v303 && (sub_100C87320() & 1) == 0 )
{
if ( (sub_100C87330() & 1) != 0 )
{
v301 = 0;
}
else
{
v329 = v325;
v255 = objc_retainAutoreleasedReturnValue((id)sub_100C75830(2, &v329));
v256 = objc_retain(v329);
objc_release(v325);
v301 = v255;
if ( !v255 )
{
v324 = objc_retainAutoreleasedReturnValue((id)com_apple_MobileActivation_ErrorDomain(
(int)"create_baa_info",
735,
-1,
v256,
(int)CFSTR("Failed to load boot manifest."),
v257,
v258,
v259,
v275));
objc_release(v256);
v305 = 0;
v301 = 0;
LABEL_240:
v44 = 0;
v296 = 0;
v298 = 0;
goto LABEL_168;
}
objc_msgSend(v314, "setObject:forKeyedSubscript:", v255, CFSTR("Image4Manifest"));
v325 = v256;
}
v35 = v286;
v7 = *(id *)v288;
v34 = v281;
}
else
{
v301 = 0;
}
if ( (sub_100C87330() & 1) != 0 )
{
v305 = 0;
LABEL_221:
v4 = v292;
v266 = v306;
v72 = v283;
LABEL_222:
v33 = v282;
v262 = v325;
goto LABEL_223;
}
is_darwinos = os_variant_is_darwinos(objc_msgSend(CFSTR("com.apple.mobileactivationd"), "UTF8String"));
v305 = 0;
if ( !v297 )
goto LABEL_221;
if ( (is_darwinos & 1) != 0 )
{
v4 = v292;
v266 = v306;
v35 = v286;
v7 = *(id *)v288;
v72 = v283;
v34 = v281;
goto LABEL_222;
}
v328 = v325;
v261 = objc_retainAutoreleasedReturnValue((id)sub_100C75830(10, &v328));
v262 = objc_retain(v328);
objc_release(v325);
v305 = v261;
if ( v261 )
{
objc_msgSend(v314, "setObject:forKeyedSubscript:", v261, CFSTR("Cryptex1Image4Manifest"));
v4 = v292;
v266 = v306;
v35 = v286;
v7 = *(id *)v288;
v33 = v282;
v72 = v283;
v34 = v281;
LABEL_223:
v32 = v280;
if ( v310 )
objc_msgSend(v314, "setObject:forKeyedSubscript:", v310, CFSTR("AppID"));
if ( v311 )
objc_msgSend(v314, "setObject:forKeyedSubscript:", v311, CFSTR("MFiProperties"));
if ( v315 )
objc_msgSend(v314, "setObject:forKeyedSubscript:", v315, CFSTR("MFiPPUID"));
if ( v266 )
objc_msgSend(v314, "setObject:forKeyedSubscript:", v266, CFSTR("MFiData"));
v327 = 0;
v267 = objc_retainAutoreleasedReturnValue(
+[NSPropertyListSerialization dataWithPropertyList:format:options:error:](
&OBJC_CLASS___NSPropertyListSerialization,
"dataWithPropertyList:format:options:error:",
v314,
100,
0,
&v327));
v287 = objc_retain(v327);
objc_release(v262);
if ( v267 )
{
-[__SecKey setObject:forKeyedSubscript:](
v72,
"setObject:forKeyedSubscript:",
v267,
CFSTR("RKProperties"));
v298 = v267;
v271 = SecKeyCreateSignature(
a1,
kSecKeyAlgorithmECDSASignatureMessageX962SHA256,
(CFDataRef)v267,
&error);
v27 = v278;
if ( v271 )
{
v296 = v271;
-[__SecKey setObject:forKeyedSubscript:](
v72,
"setObject:forKeyedSubscript:",
v271,
CFSTR("RKPropertiesSignature"));
v44 = objc_retain(v72);
v324 = v287;
}
else
{
v324 = objc_retainAutoreleasedReturnValue((id)com_apple_MobileActivation_ErrorDomain(
(int)"create_baa_info",
810,
-1,
error,
(int)CFSTR("Failed to sign data with ref key."),
v272,
v273,
v274,
v275));
objc_release(v287);
v44 = 0;
v296 = 0;
}
goto LABEL_133;
}
v324 = objc_retainAutoreleasedReturnValue((id)com_apple_MobileActivation_ErrorDomain(
(int)"create_baa_info",
799,
-1,
v287,
(int)CFSTR("Could not convert dictionary to xml data."),
v268,
v269,
v270,
v275));
objc_release(v287);
v44 = 0;
v296 = 0;
v298 = 0;
LABEL_170:
v27 = v278;
a1 = v279;
LABEL_171:
CFRelease(cf);
if ( v284 )
CFRelease(v284);
LABEL_173:
if ( v289 )
CFRelease(v289);
v205 = v294;
if ( !v294 )
goto LABEL_177;
goto LABEL_176;
}
v324 = objc_retainAutoreleasedReturnValue((id)com_apple_MobileActivation_ErrorDomain(
(int)"create_baa_info",
770,
-1,
v262,
(int)CFSTR("Failed to load cryptex1 manifest."),
v263,
v264,
v265,
v275));
objc_release(v262);
v305 = 0;
goto LABEL_240;
}
v249 = os_variant_is_darwinos(objc_msgSend(CFSTR("com.apple.mobileactivationd"), "UTF8String"));
objc_release(v248);
if ( (v249 & 1) != 0 )
{
v302 = 0;
LABEL_206:
v34 = v281;
goto LABEL_207;
}
v330[0] = v160;
v250 = objc_retainAutoreleasedReturnValue((id)sub_100C75830(9, v330));
v251 = objc_retain(v330[0]);
objc_release(v160);
v302 = v250;
if ( v250 )
{
objc_msgSend(v244, "setObject:forKeyedSubscript:", v250, CFSTR("LocalPolicy"));
v325 = v251;
v35 = v286;
v7 = *(id *)v288;
goto LABEL_206;
}
v324 = objc_retainAutoreleasedReturnValue((id)com_apple_MobileActivation_ErrorDomain(
(int)"create_baa_info",
719,
-1,
v251,
(int)CFSTR("Failed to load cryptex1 local policy."),
v252,
v253,
v254,
v275));
objc_release(v251);
v305 = 0;
v301 = 0;
v44 = 0;
v296 = 0;
v298 = 0;
LABEL_167:
v302 = 0;
LABEL_168:
v4 = v292;
v7 = *(id *)v288;
LABEL_169:
v35 = v286;
v33 = v282;
v72 = v283;
v32 = v280;
v34 = v281;
goto LABEL_170;
}
v324 = objc_retainAutoreleasedReturnValue((id)com_apple_MobileActivation_ErrorDomain(
(int)"create_baa_info",
637,
-1,
v160,
(int)CFSTR("Failed to create reference key attestation (nonce: %@)."),
v161,
v162,
v163,
(char)v318));
objc_release(v160);
v305 = 0;
v301 = 0;
v44 = 0;
v314 = 0;
v296 = 0;
v298 = 0;
v312 = 0;
}
else
{
v324 = objc_retainAutoreleasedReturnValue((id)com_apple_MobileActivation_ErrorDomain(
(int)"create_baa_info",
628,
-1,
0,
(int)CFSTR("Failed to encode RK public key as data."),
v154,
v155,
v156,
v275));
objc_release(v79);
v305 = 0;
v301 = 0;
v44 = 0;
v314 = 0;
v296 = 0;
v298 = 0;
v312 = 0;
v299 = 0;
}
v302 = 0;
v4 = v292;
goto LABEL_169;
}
v324 = objc_retainAutoreleasedReturnValue((id)com_apple_MobileActivation_ErrorDomain(
(int)"create_baa_info",
622,
-1,
0,
(int)CFSTR("Failed to copy RK public key."),
v150,
v151,
v152,
v275));
objc_release(v79);
v305 = 0;
v301 = 0;
v44 = 0;
}
else
{
v324 = objc_retainAutoreleasedReturnValue((id)com_apple_MobileActivation_ErrorDomain(
(int)"create_baa_info",
612,
-1,
v79,
(int)CFSTR("Failed to retrieve %@."),
v146,
v147,
v148,
(char)CFSTR("BuildVersion")));
objc_release(v79);
v305 = 0;
v301 = 0;
}
v314 = 0;
v296 = 0;
v298 = 0;
v312 = 0;
v299 = 0;
}
else
{
v324 = objc_retainAutoreleasedReturnValue((id)com_apple_MobileActivation_ErrorDomain(
(int)"create_baa_info",
606,
-1,
0,
(int)CFSTR("Failed to retrieve %@."),
v141,
v142,
v143,
(char)CFSTR("SerialNumber")));
objc_release(v79);
v305 = 0;
v301 = 0;
v44 = 0;
v314 = 0;
v296 = 0;
v298 = 0;
v312 = 0;
v299 = 0;
v307 = 0;
}
v290 = 0;
goto LABEL_167;
}
v324 = objc_retainAutoreleasedReturnValue((id)com_apple_MobileActivation_ErrorDomain(
(int)"create_baa_info",
582,
-1,
0,
(int)CFSTR("Failed to retrieve %@."),
v117,
v118,
v119,
(char)CFSTR("UniqueChipID")));
objc_release(v79);
v305 = 0;
v301 = 0;
v44 = 0;
v314 = 0;
v296 = 0;
v298 = 0;
v312 = 0;
v299 = 0;
}
else
{
v324 = objc_retainAutoreleasedReturnValue((id)com_apple_MobileActivation_ErrorDomain(
(int)"create_baa_info",
543,
-4,
0,
(int)CFSTR("UCRT is unavailable."),
v112,
v113,
v114,
v275));
objc_release(v79);
v305 = 0;
v301 = 0;
v44 = 0;
v314 = 0;
v296 = 0;
v298 = 0;
v312 = 0;
v299 = 0;
v34 = 0;
}
v33 = 0;
v32 = 0;
a1 = 0;
v27 = 0;
v307 = 0;
v290 = 0;
v302 = 0;
v4 = v292;
v35 = v286;
v7 = *(id *)v288;
v72 = v283;
goto LABEL_171;
}
if ( -[NSNumber boolValue](v41, "boolValue") )
v43 = 0;
else
v43 = 2;
v334[2] = 0;
v44 = (__SecKey *)objc_retainAutoreleasedReturnValue((id)security_create_system_key_attestation((int)a1, v43, v38));
v48 = objc_retain(0);
if ( !v44 )
{
v324 = objc_retainAutoreleasedReturnValue((id)com_apple_MobileActivation_ErrorDomain(
(int)"create_baa_info",
477,
-1,
v48,
(int)CFSTR("Failed to create reference key attestation."),
v45,
v46,
v47,
v275));
objc_release(v48);
v302 = 0;
v31 = 0;
v307 = 0;
v27 = 0;
a1 = 0;
v32 = 0;
v33 = 0;
v34 = 0;
v298 = 0;
v299 = 0;
v35 = 0;
v7 = 0;
v316 = 0;
v296 = 0;
v312 = 0;
v314 = 0;
goto LABEL_47;
}
v316 = v44;
v49 = SecKeyCopyPublicKey(a1);
if ( !v49 )
{
v324 = objc_retainAutoreleasedReturnValue((id)com_apple_MobileActivation_ErrorDomain(
(int)"create_baa_info",
483,
-1,
0,
(int)CFSTR("Failed to copy RK public key."),
v50,
v51,
v52,
v275));
objc_release(v48);
v302 = 0;
v31 = 0;
v307 = 0;
v27 = 0;
a1 = 0;
goto LABEL_45;
}
v294 = v49;
v53 = SecKeyCopyExternalRepresentation(v49, &error);
objc_release(v320);
if ( v53 )
{
v57 = SecAccessControlCreate(0, &error);
if ( v57 )
{
v61 = kSecAttrAccessibleUntilReboot;
v62 = v57;
v291 = (const void *)v57;
if ( (SecAccessControlSetProtection(v57, kSecAttrAccessibleUntilReboot, &error) & 1) != 0 )
{
v334[1] = v48;
v66 = (__SecKey *)sub_100C6E934(v62, v40, v4);
v42 = objc_retain(v48);
objc_release(v48);
if ( v66 )
{
v320 = v53;
a1 = v66;
v289 = v66;
v37 = v316;
goto LABEL_49;
}
v324 = objc_retainAutoreleasedReturnValue((id)com_apple_MobileActivation_ErrorDomain(
(int)"create_baa_info",
508,
-1,
v42,
(int)CFSTR("Failed to create reference key."),
v67,
v68,
v69,
v275));
v48 = v42;
}
else
{
v324 = objc_retainAutoreleasedReturnValue((id)com_apple_MobileActivation_ErrorDomain(
(int)"create_baa_info",
502,
-1,
error,
(int)CFSTR("Failed to set ACL protection to %@."),
v63,
v64,
v65,
v61));
}
}
else
{
v324 = objc_retainAutoreleasedReturnValue((id)com_apple_MobileActivation_ErrorDomain(
(int)"create_baa_info",
497,
-1,
error,
(int)CFSTR("Failed to create access control."),
v58,
v59,
v60,
v275));
v291 = 0;
}
v320 = v53;
}
else
{
v324 = objc_retainAutoreleasedReturnValue((id)com_apple_MobileActivation_ErrorDomain(
(int)"create_baa_info",
489,
-1,
error,
(int)CFSTR("Failed to encode RK public key as data."),
v54,
v55,
v56,
v275));
v320 = 0;
v291 = 0;
}
objc_release(v48);
v302 = 0;
v305 = 0;
v301 = 0;
v72 = 0;
v44 = 0;
v314 = 0;
v296 = 0;
v298 = 0;
v312 = 0;
v7 = 0;
v35 = 0;
v299 = 0;
v34 = 0;
v33 = 0;
v32 = 0;
a1 = 0;
v27 = 0;
v307 = 0;
v290 = 0;
v205 = v294;
LABEL_176:
CFRelease(v205);
LABEL_177:
if ( v290 )
CFRelease(v290);
v31 = v291;
LABEL_180:
if ( error )
{
v295 = v44;
v230 = v27;
v231 = a1;
v232 = v32;
v233 = v4;
v234 = v33;
v235 = v34;
v236 = v72;
v237 = v35;
v238 = v7;
v239 = v31;
CFRelease(error);
v31 = v239;
v7 = v238;
v35 = v237;
v72 = v236;
v34 = v235;
v33 = v234;
v4 = v233;
v32 = v232;
a1 = v231;
v27 = v230;
v44 = v295;
}
error = 0;
if ( v31 )
CFRelease(v31);
if ( a3 && !v44 )
*a3 = objc_retainAutorelease(v324);
v240 = objc_retain(v44);
objc_release(v302);
objc_release(v324);
objc_release(v306);
objc_release(v315);
objc_release(v300);
objc_release(v311);
objc_release(v310);
objc_release(v322);
objc_release(v313);
objc_release(v308);
objc_release(v309);
objc_release(v318);
objc_release(v321);
objc_release(v307);
objc_release(v27);
objc_release(a1);
objc_release(v32);
objc_release(v33);
objc_release(v34);
objc_release(v299);
objc_release(v35);
objc_release(v7);
objc_release(v320);
objc_release(v316);
objc_release(v296);
objc_release(v312);
objc_release(v298);
objc_release(v314);
objc_release(v240);
objc_release(v72);
objc_release(v301);
objc_release(v319);
objc_release(v305);
objc_release(v4);
if ( ((vars8 ^ (2 * vars8)) & 0x4000000000000000LL) != 0 )
__break(0xC471u);
v241 = objc_autoreleaseReturnValue(v240);
}
用 SE 里封装的密钥 + 苹果预置的证书链，生成了一份 attestation（证明）blob，这个 blob 里面带着证书和签名，对“某些设备硬件字段 + 公钥”做了绑定。
这个“证书/attestation blob”是 依赖安全硬件（Secure Enclave / Apple KeyStore）生成的，而且签名覆盖了与这台硬件绑定的一些信息。
格式如下：
SEQUENCE
INTEGER 02
SEQUENCE
OCTETSTRING xxxxdeca90b4fd52da1c016730a81dcb281f6c4dbb973e6b8438e6827530a177
OCTETSTRING xxxx980ea0e8b0211cc342dc42067f1b..(total 65bytes)..2c8c482afb33b9e84221b49ffd1d81fa
OCTETSTRING xxxx730da8259089a9b9b02bd4a455fd
OCTETSTRING xxxxce59b8232b317ff32beb21237051
OCTETSTRING xxxx56c0b70138d40071067ee100013f..(total 1074bytes)..4b70f5283c1085f6a8d25107d6b9a94b
将采集的硬件信息与证书签名信信息组合成 plist格式数据上报到服务器端
0 : User-Agent = {contents = "iOS Device Activator (MobileActivation-834.100.27) - devicecheckd"}
3 : Content-Type = {contents = "application/xml"}
4 : Content-Length = 9822
6 : x-jmet-deviceid = {contents = "00008110-303C30C91A06484E"}
}
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>RKCertification</key>
<data>
MIIExQIBAjxxxxxxxxP4C3sqQtP1S2hwBZzCoHcsoH2xNu5c+a4Q45oJ1MKF3BEEEiTxl
3JiRx7vW49DhREeRVU04QQBLnB7Lm7nI8+D2ayS/PMZ7rcmhC89px3xHSlAvDl2MQopT
SHXxnC/0Bs/6KgQQ1SciqWRdHp3U/vxi/S1O/wQQNpOm/5v25ojsX99XACzgpwSCBDHO
l9izvodcLU0pQSlaNXHlIp7nMLqh/QkyEI+a/YlGFaqTR/PgZbq4o37Rw6SCZQ+MjU2F
uzuq9O6sTaKVBcw4aDW0oPDmZgH5m1ZlDwvUqQFAy+OvNrO8L4D4zSo2lW8BRqR89jkx
WAixq12iERj/4+orIFAFGG86P/PnRRUsC8uR1tkqM4NpjXiLNUlO/X7VF1iY7g3nf5JS
uxAqGMNZ8eEXXHJ9I5XuPDC/B1BvpoM/Pk65CPRbaw5ojMr+McZ+IsuWQBb21dxMldAy
MMg5sFEt5+uIqWFaVyjFMfFCqYTfSofsyFQO8woaPegrmqFBVJRTGbbPkEDEVaWgLprd
VuoE8hkSvecWaBwsyNH0UmTLMOwrMHF12RLVPc6qChr4ki0FkIP9crLHhQwxVYeXgRpA
ClcA6uNFFa412RdhRhv5T88NBVRNu9ewCm3gWBnhMF10PltNVGJ1ZRjhZS0ghaVnqHpj
DA+2pnObaocLzgC9bOl0RExDwVwxLp7/hD/0jqZ+GqGSPgXYGY3FxnIB9n1e35KNjWaV
ur1WgHps5TEdi9LHxur2iqv5IkmxXNojxUoWprRc36RCBkurDLJiCM6Es8/63z1mZQ9h
a4iA5+u0PStVpCSjOJ/0gn01pIxxxeppomCsT6980+l1HYi7zsD/tBkOznpFwGS5Ki9h
RErTaCc2/9YGjgWVOBv1w5dEnBnwb1P59Qgpmnx3k9eyczaxt3OXOnKVwzYKtowI0OeD
F9jM1yN9KZVtAqQJM4H8N+W3f0w8x+PwYHUf/0AHdAK/WyUHObDkoPzZOY+N7aFvkSf8
aVcxC5MMCM6YFGpeDN9yoroti2mxxxelwDYx7Q8wuIeBBDiJfHRMWXxQEbej2XoYxGs4
tz8Qh0z5p0kL5bb5MERKHPkaIg+slVxEpoCAxCnNHiTHjK3gEXhgyxkiBmLO4ENSGDTp
+5PX64sez9Sb95ua6PhFFJYRXFgnp2IqffOoxx9Pxtxf7aKvpmlhPu+YGfbpz+mF+BSQ
Y0a/ybU0xySRCKfTlepT8J+3HGNGl6HmjKPMDgj1SIloAoNR+VATnMs0THe7ZZTYLI+m
bghSAHqDcjZCOWbRp19gSbUz71WU/sDAbN477biemxOYszVzS6cckGmmoDSLuav8RCSH
9h254xTGB5VzEjT5lqpsWJ0u+IJUW7gfCbkq1IGer5PdmVrzAluNTS4G85iHnXi3EKJB
wJ1upCRMjwlQRFlKP/SDo1TTQUa1kX0x+o1bFjvroyNKq+wL56PRQex22FzN00gsursF
dstdB+WPHde2jfeVmielZ+wxw59wEuE2CLeS5D1CLIEGYgsTyoLxl6QQ80UjaphhAuVA
A7HqcmXNe/6AOGdL42LHUhF23K5Fd55i8yaJP0sMwzY1e3nPbeunZmIiL1KiAFcKLzpm
cg==
</data>
<key>RKProperties</key>
<data>
ff94bfwgfmVyc2lvbjxxxxxwIiBlbmNvZGluZz0iVVRGLTgiPz4KPCFET0NUWVBFIHBs
aXN0IFBVQkxJQyAiLSxxxxxwbGUvL0RURCBQTElTVCAxLjAvL0VOIiAiaHR0cDovL3d3
dy5hcHBsZS5jb20vRFREcy9Qcm9wZXJ0eUxpc3QtMS4wLmR0ZCI+CjxwbGlzdCB2ZXJz
aW9uPSIxLjAiPgo8ZGljdD4KCTxrZXk+QXBwSUQ8L2tleT4KCTxzdHJpbmc+Y29tLmFw
cGxlLmRldmljZWNoZWNrZDwvf3RyaW5nPgoJPGtleT5Cb2FyZElkPC9rZXk+Cgk8aW50
ZWdlcj4yNDwvaW50ZWdlcj4KffxrZXk+QfFfZXffPC9rZXk+Cgk8aW50ZWdlcj4wPC9p
bnRlZ2VyPgoJPGtleT5DZXJ0VHlwZTwva2V5PgoJPGludGVnZXI+MDwvaW50ZWdlcj4K
CTxrZXk+Q2hpcElEPC9rZXk+Cgk8aW50ZWdlcj4zMzA0MDwvaW50ZWdlcj4KCTxrZXk+
TG9jYWxQb2xpY3k8L2tleT4KCTxkYXRhPgoJTUlJTVFCWUVTVTFITkRBVUZnUkpUVFJR
RmdSc2NHOXNGZ014TGpBRUFRQ2dnZfdfTUfJfUhCWUVTVTAwVFFJQkFER0MKCUFpUC9o
T3FGbkVLQ0Fob3dnZ0lXRmdSTlFxxUNNWUlDRFArRTZvV2NVSUlCbnpDQ0Fac1dCRTFC
VGxBeGdnR1IvNFNTCgl2YVJFQ3pBSkZnUkNUMUpFQWdFWS80U2FsYUJQQ3pBSkZnUkRS
VkJQQWdFQi80U2FvWkpRRFRBTEZnUkRTRWxRQWdNQQoJZ1JEL2hKckJwRThMTUFrV0JF
TlFVazhCQWYvL2hKck5pa01MTUFrV0JFTlRxVU1CQfWYvL2hLcU5ra1FSTUE4V0JFVkQK
CVNVUUNCeGhwb2p3Z0lCNy9oWnFSbmswTE1Ba1dCRk5FVDAwQ0FRSC9odU85eEc4TE1B
a1dCR3h2WW04QkFmLy9odlBOCgkwbWc2TURnV0JHNXphV2dFTUlQc0gwYlAybmtaaDNo
NVF3U2RXUU1CL0NoekZrWlMyczE0SxlWxnJTdDZwR2RlaDIvSgoJd3VnR2V4dFU5cWNm
Uy8rSGs3M2NhQ293S0JZRWNtOXVhQVFnU2srUmVVVnd1QWlCeEw0cWM5WmlZZUFFQ3Y1
OVN2dmwKCXk4SWhTM2ZaK2k3L2g1dkIwbWc2TURnV0JITndhV2dFTUo3V1ZSSWhWNU13
ZXlXa2VHdVo5STVSbUFSNGQycm9aZnFQCglmOE92aXljRkFjUEs0cHJDUXVTN3BSa3lB
WDQxVi8rSG04bnNiaDR3SEJZRWMzSjJiZ1FVRzIrWkp3aXFselVHSUkzQQoJVmZMcklJ
L3RkMGYvaDdQVjBtUWFNQmdXQkhaMWFXUUVFQUFBQUFBQUFBQUFBQUFBQUFBQUFBRC9o
dVBCM214ZE1Gc1cKCUJHeHdiMnd4VS8rRW9wMm1WRG93T0JZRVJFZFRWQVF3MFFGVU9N
U29rWEtqQkkxZXJyeXkzbVYzZGNacStHaVJhcWVXCglHUUk5Z29haFJoREhKZVNSem1m
MERMMVl0M2h5LzRTcXJZcFpDekFKRmdSRlMwVlpBUUgvQklJQ0FFRmdqK1krQkpheAoJ
MU1jS3dGQkdFMHpvcElKZkJWY2dKcG5MeDV2MFA2L1VsbG1jWmZYcnVYK2t1K2xRYm9H
UXBkQ3ZZcnp6K3l4bXVjS00KCWtDOXlJdlpzMndjMldrMzdDeHl4a1lXZ2UvckZmSERC
WFpQS3hTc1hIRFpkVXVjanFQbGlqVkJGV1pXekJjc0hQd2M3CgkyOFJUcTNWQU9aeG0x
RXo3RVFlVHRmUDFocDN0WEdic0xaMlZ0aVcyWG12VDFDeCsvajNCbnhnNGNtQy9EUjJW
SmpZaQoJUUx2V0dJSTNSVUY5cUEwL3BBeGcvQ3JCeXI4Zkx3Uk5QV2haOGMwRW04eVhi
U2MxZ1h2K0NlUnJJcVBNZXFWU1o3cGoKCXdGamlhTWlwRXEwRUJhQkcyOG9xNkNCZE9E
K1ZDUWxYSzBNOEdqUXZXc3FpcS9UVDRlQkVGV0NQTzRKLzU2bzE4WkxpCgk5OFdZaTQy
RVBLb0RHM0ZyTFhreWNWR0E0QTdnVlhIczBnS25TeWJEKzZmYlk0SGF5cWtpUEM4ZHl1
QWlUNXF5WThwUwoJdVp5TTY5aEs4dEJleFpiWDdiOFdEd29HVElzd3RST0d1SGZJbEpS
bXBIVXF2YnRUcWs4Qk42cFBwaHlNMlJqb1p4QmgKCXlBdzdEQ0M5Y0tuTkpnamhQTE91
aFRaUlU0aCtqMXo5WnY2UmdpSU44L21wTkxZV2pNMmtFWEw1eVRKbVhYVnBOcThICgll
UGx5VUF4TnF6dkFLVFpZQjMrODROOFF4ekF4bVk4eFFBcUpVb1ROWWVZSjZnSWZXcnFM
VktsRFdDcy9kUE5kc2xndwoJNHN4ci9xS09kcDI1cm5ST1hyK21Kc080Qm4rNkI2Vmhm
WndWWnpmT2VkN0toZ3dMaGxrSXRYY25UbEN0TUlJSDVEQ0MKCUIrQXdnZ1hJb0FNQ0FR
SUNFRDM5ajV5cU5WOXZVQ0xzTjAyRWRCOHdEUVlKS29aSWh2Y05BUUVNQlFBd1N6RW5N
Q1VHCglBMVVFQXd3ZVFYQndiR1VnVTJWamRYSmxJRUp2YjNRZ1VtOXZkQ0JEUVNBdElF
YzJNUk13RVFZRFZRUUtEQXBCY0hCcwoJWlNCSmJtTXVNUXN3Q1FZRFZRUUdFd0pWVXpB
ZUZ3MHlNREEzTWpJeE9EQTJORGhhRncwek1EQTNNak14T0RBMk5EaGEKCU1GSXhMakFz
QmdOVkJBTU1KVlE0TVRFd0xWTkVUMDB4TFZKbFkyOTJaWEo1UW05dmRDMVNaWFpCTFVa
aFkzUnZjbmt4CglFekFSQmdOVkJBb01Da0Z3Y0d4bElFbHVZeTR4Q3pBSkJnTlZCQVlU
QWxWVE1JSUNJakFOQmdrcWhraUc5dzBCQVFFRgoJQUFPQ0FnOEFNSUlDQ2dLQ0FnRUF5
aVFHMk1leXZJeFlCQThJdis1bVd0cG83SHJ6ZUdvdU1sSlR1SHFqbmNUYzdDVEYKCUlp
WlUvT1RMaVRoT2FsdS85L29rQnBqY2MyY0hVdXV6NFlMeUhRYkNFYzllam5MdTFhY2lY
Q3MvVHZaZmoyTFpScnZsCgk4Tk1xaTBrNUE5RHlUVGxzYnZWRDhXQmdIZ3VUN2MySjh2
N0tpUnM5MkZUWjZ6OGROK0ZPa1VjM3dTUnRiOFBaQ2QrWgoJREdXblpDYzZyZFlkOFRJ
WDhNK0dCYzhGeUVEaXFhUmNONmpNNzJkRkRDL0NCQjZxcmFKZDlEQ1VzRTdDVXJ5Zk02
VWYKCXpqbVNyTGNnSkZYSjhZK3k0N2VjaGcrY2RDTytOQThBYjQzL2E1N0xJaTBtT0JI
V2FIUytHTkExR3c3WkpqdHdNQXcvCgllbW9heXVNYXB6d1RlRjFNTW1qKzNTa0h2WEdT
T0JtcU5SYVBoT2hRd1p3bkpsaEhpSkNzaVl1dWJ3N3Bxa0MycytiYgoJekx3MkxNakEy
UUppQWdDOHJmU3VYb2RUT2EzRkxhK1RmSlJ4TjhoL3p2aEU5Wmk0RDNBeC8xQ2dBS1Qx
bTNXT3JtQ1AKCURVZDZKOXZ5c3plTWdlZ3RTWldHdU9oL1o1OGFDR1lROTFoMVdpYSt5
VHdvU1J4c1lYdTR5ZldkT0ZlelpYQjlzMmFqCglWUEFRKzI2eE8xWlRsR29CWXVHcU1y
TGEvaUV5S1J1UHpzZDVzcC9uU29wdE43dDQwS0h5Uy9KL1luT2RoZTltREdqUwoJMTZE
aFJBSjRWdHBubDFmeHhubFdNcXpJeUNTMWxtTDdWeWxMdkF1YkpKZTF6MGtaTm9CNWln
SFB5Q3V2ZW5FUVpSVkQKCUlBcFJ5YlpqSk9Pc1FoVUY3dGFYVUQwQ0F3RUFBYU9DQXJj
d2dnS3pNQXdHQTFVZEV3RUIvd1FDTUFBd0h3WURWUjBqCglCQmd3Rm9BVVU3ZUV0TEhv
T0R5Vzc2UldMdm96M1BFUWtPQXdIUVlxxlIwT0JCWUVGRlhYTkNqTWlaMzlYVFlGU3B0
TgoJTXFNRlNwcWNNQTRHQTFVZER3RUIvd1FFQXdJSGdEQ0NBbEVHQ2lxR1NJYjNZMlFH
QVE4QkFmOEVnZ0krTVlJQ092K0UKCTZvV2NVSUlCd1RDQ0FiMFdCRTFCVGxBeGdnR3ov
NFNTdVlaSUREQUtGZ1JDVGtOSW9RSUZBUCtFa3Iya1JBd3dDaFlFCglRazlTUktBQ0JR
RC9oSnFWb0U4TE1Ba1dCRU5GVUU4Q0FRSC9oSnFoa2xBTk1Bc1dCRU5JU1ZBQ0F3Q0JF
UCtFbXNHawoJVHd3d0NoWUVRMUJTVDZBQ0JxRCxxSnJxxWtNTU1Bb1dCRU5UUlVPZ0Fn
VUEvNFNxalpKRUREQUtGZ1JGUTBsRW9BSUYKCUFQK0ZtcEdlVFFzd0NSWUVVMFJQVFFJ
QkFmK0dpOVh3YVF3d0NoWUVZWFY0YWFFQ0JRRC9ob3ZWOEhBTU1Bb1dCR0YxCgllSENo
QWdVQS80Ymp2Y1J2Q3pBSkZnUnNiMkp2QVFILy80Ymp3ZHhvRERBS0ZnUnNjRzVvb1FJ
RkFQK0c4ODNTYUF3dwoJQ2hZRWJxxxBxS0FDQlFEL2g1TzkzR2dNTUFvV0JISnZibWln
QWdVQS80ZVR3ZHhvRERBS0ZnUnljRzVvb1FJRkFQK0gKCW02WGdNQXd3Q2hZRWMybHdN
S0VDQlFEL2g1dWw0REVNTUFvV0JITnBjREdoQWdVQS80ZWJwZUF5RERBS0ZnUnphWEF5
CglvUUlGQVArSG02WGdNd3d3Q2hZRWMybHdNNkVDQlFEL2g1dTF4REFNTUFvV0JITnRZ
akNoQWdVQS80ZWJ0Y1F4RERBSwoJRmdSemJXSXhvUUlGQVArSG03WEVNZ3d3Q2hZRWMy
[复制链接]
