submitDevelopmentCSR: Please update to Xcode 7.3 or later to continue developing with your Apple ID. #96
Comments
|
Thanks, I’ll use this ticket as the one to post progress updates on. Just found out about it myself!
First instinct is to update the values hard coded here: https://github.com/Matchstic/ReProvision/blob/1dc76d61361bd30c716e848e73bf9a3d7c35fde2/Shared/libProvision/Apple%20Services/EEAppleServices.m#L60
… On 6 Nov 2019, at 20:02, xMarkSt ***@***.***> wrote:
Describe the bug
I cannot sign the IPA for h3lix jailbreak. When at 30%, it gives the following error message:
submitDevelopmentCSR: Please update to Xcode 7.3 or later to continue developing with your Apple ID.
I don't know if this also happens with other apps.
To Reproduce
Steps to reproduce the behavior:
Try to resign an installed application, in my case h3lix jailbreak.
The error message appears in the notification bar.
Expected behavior
The app to be resigned.
Screenshots
Device (please complete the following information):
iOS 10.3.3
iPad 4
—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or unsubscribe.
|
|
I'm looking into this myself for AltStore. It seems that there are three new headers that need to be included when making requests to Apple: |
|
That’s a huge help, I’ll keep an eye on your progress!
… On 6 Nov 2019, at 20:02, xMarkSt ***@***.***> wrote:
Describe the bug
I cannot sign the IPA for h3lix jailbreak. When at 30%, it gives the following error message:
submitDevelopmentCSR: Please update to Xcode 7.3 or later to continue developing with your Apple ID.
I don't know if this also happens with other apps.
To Reproduce
Steps to reproduce the behavior:
Try to resign an installed application, in my case h3lix jailbreak.
The error message appears in the notification bar.
Expected behavior
The app to be resigned.
Screenshots
Device (please complete the following information):
iOS 10.3.3
iPad 4
—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or unsubscribe.
|
|
Had a chance to do some digging of my own just now. It appears that the sign in process on idmsa.apple.com via clientDaw.cgi gives a “JSESSIONID” back in the “Set-Cookie” response header. Might be relevant to check into Xcode’s user sign in process for the remaining two header fields.
… On 7 Nov 2019, at 00:41, Riley Testut ***@***.***> wrote:
I'm looking into this myself for AltStore. It seems that there are three new headers that need to be included when making requests to Apple: X-Apple-GS-Token, DSESSIONID, and X-Mme-Device-Id. I'm still researching, but there's more info here: altstoreio/AltStore#57
—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub, or unsubscribe.
|
|
I've been looking into this myself for Supercharge, and I made a few discoveries which I'd like to share here in the interest of figuring this out quickly (spoiler alert: if we want future-proofing, those three headers aren't enough).
All in all, any solution to this will probably have to involve entirely reverse-engineering AuthKit, or coming up with a super creative workaround |
|
thank you for your work guys! |
|
Awesome, thanks so much for this @kabiroberai! I'll move my own progress updates here then to consolidate everything in once place. Clarifying my As for creative workarounds, do we know if iCloud on Windows uses this new auth flow for anything? 🤔 |
I would imagine that the new authentication code requires a chain of trust that ends with Apple's certificate. |
|
I’m having this exact same issue on an iPhone X running 12.4 with Chimera. |
|
Got it working, Could now generate #import <Foundation/Foundation.h>
@interface AKAppleIDSession : NSObject
- (id)_pairedDeviceAnisetteController;
- (id)_nativeAnisetteController;
- (void)_handleURLResponse:(id)arg1 forRequest:(id)arg2 withCompletion:(id)arg3;
- (void)_generateAppleIDHeadersForSessionTask:(id)arg1 withCompletion:(id)arg2;
- (id)_generateAppleIDHeadersForRequest:(id)arg1 error:(id *)arg2;
- (id)_genericAppleIDHeadersDictionaryForRequest:(id)arg1;
- (void)handleResponse:(id)arg1 forRequest:(id)arg2 shouldRetry:(char *)arg3;
- (id)appleIDHeadersForRequest:(id)arg1;
- (void)URLSession:(id)arg1 task:(id)arg2 getAppleIDHeadersForResponse:(id)arg3 completionHandler:(id)arg4;
- (id)relevantHTTPStatusCodes;
- (id)copyWithZone:(struct _NSZone *)arg1;
- (void)encodeWithCoder:(id)arg1;
- (id)initWithCoder:(id)arg1;
- (id)initWithIdentifier:(id)arg1;
- (id)init;
@end
int main(int argc, char *argv[]) {
@autoreleasepool {
NSMutableURLRequest* req = [[NSMutableURLRequest alloc] initWithURL:[[NSURL alloc] initWithString:@"https://developerservices2.apple.com/services/QH65B2/listTeams.action?clientId=XABBG36SBA"]];
[req setHTTPMethod:@"POST"];
AKAppleIDSession* session = [[AKAppleIDSession alloc] initWithIdentifier:@"com.apple.gs.xcode.auth"];
NSMutableURLRequest* nreq = [session appleIDHeadersForRequest:req];
NSLog(@"%@",nreq);
}
}This code will copy Bellow is my code for amfid on macOS 18G103(10.14.6), argv[1] is the pid of #include <Security/Authorization.h>
#include <errno.h>
#include <mach/mach.h>
#include <mach/mach_vm.h>
#include <stdio.h>
#include <stdlib.h>
#include <sys/mman.h>
#include <sys/ptrace.h>
#include <sys/types.h>
#include <unistd.h>
int acquireTaskportRight() {
OSStatus stat;
AuthorizationItem taskport_item[] = {{"system.privilege.taskport:"}};
AuthorizationRights rights = {1, taskport_item}, *out_rights = NULL;
AuthorizationRef author;
int retval = 0;
AuthorizationFlags auth_flags =
kAuthorizationFlagExtendRights | kAuthorizationFlagPreAuthorize |
kAuthorizationFlagInteractionAllowed | (1 << 5);
stat = AuthorizationCreate(NULL, kAuthorizationEmptyEnvironment, auth_flags,
&author);
if (stat != errAuthorizationSuccess) {
return 0;
}
stat = AuthorizationCopyRights(
author, &rights, kAuthorizationEmptyEnvironment, auth_flags, &out_rights);
if (stat != errAuthorizationSuccess) {
printf("fail");
return 1;
}
return 0;
}
void check(int cond, char *msg) {
if (!cond) {
printf("%s\n", msg);
exit(-1);
}
}
int main(int argc, char *argv[]) {
int infoPid;
kern_return_t kret;
mach_port_t task;
thread_act_port_array_t threadList;
mach_msg_type_number_t threadCount;
x86_thread_state64_t state;
if (argc < 2) {
kret = pid_for_task(mach_task_self(), &infoPid);
if (kret != KERN_SUCCESS) {
mach_error("pid_for_task():", kret);
exit(0);
}
} else
infoPid = atoi(argv[1]);
if (acquireTaskportRight() != 0) {
printf("acquireTaskportRight() failed!\n");
exit(0);
}
kret = task_for_pid(mach_task_self(), infoPid, &task);
if (kret != KERN_SUCCESS) {
printf("task_for_pid() failed with message %s!\n", mach_error_string(kret));
exit(0);
}
kern_return_t err;
mach_msg_type_number_t region_count = VM_REGION_BASIC_INFO_COUNT_64;
memory_object_name_t object_name = MACH_PORT_NULL; /* unused */
mach_vm_size_t target_first_size = 0x1000;
mach_vm_address_t target_first_addr = 0x0;
struct vm_region_basic_info_64 region = {0};
printf("[+] About to call mach_vm_region\n");
err = mach_vm_region(task, &target_first_addr, &target_first_size,
VM_REGION_BASIC_INFO_64, (vm_region_info_t)®ion,
®ion_count, &object_name);
if (err != KERN_SUCCESS) {
printf("[-] Failed to get the region: %s\n", mach_error_string(err));
return -1;
}
printf("[+] Got base address\n");
uint64_t base = target_first_addr;
printf("binary load address: 0x%llx\n", base);
task_suspend(task);
vm_offset_t buf;
unsigned int dataCnt = 8;
kret = vm_read(task, base, 8, &buf, &dataCnt);
// assert(*(int64_t*)buf==0x1000007feedfacf);
char patched[0x4] = {0x31,0xc0,0x29,0xdb};
kret = vm_protect(task, base, target_first_size, 0, VM_PROT_ALL);
printf("%s\n", mach_error_string(kret));
kret = vm_write(task, base + 0x3294, (pointer_t)patched, 0x4);
printf("%s\n", mach_error_string(kret));
task_resume(task);
return 0;
} |
|
@TrungNguyen1909 for what it's worth, you can also disable amfid by setting |
|
I think our best bet would be to wait for an official update from Matchstic himself? I don’t mind using the Cydia Impactor every 7 days within a laptop for the time being until this gets resolved.
… On Nov 6, 2019, at 12:12 PM, Matt Clarke ***@***.***> wrote:
Thanks, I’ll use this ticket as the one to post progress updates on. Just found out about it myself!
First instinct is to update the values hard coded here: https://github.com/Matchstic/ReProvision/blob/1dc76d61361bd30c716e848e73bf9a3d7c35fde2/Shared/libProvision/Apple%20Services/EEAppleServices.m#L60
> On 6 Nov 2019, at 20:02, xMarkSt ***@***.***> wrote:
>
> Describe the bug
> I cannot sign the IPA for h3lix jailbreak. When at 30%, it gives the following error message:
> submitDevelopmentCSR: Please update to Xcode 7.3 or later to continue developing with your Apple ID.
> I don't know if this also happens with other apps.
>
> To Reproduce
> Steps to reproduce the behavior:
>
> Try to resign an installed application, in my case h3lix jailbreak.
> The error message appears in the notification bar.
> Expected behavior
> The app to be resigned.
>
> Screenshots
>
>
> Device (please complete the following information):
>
> iOS 10.3.3
> iPad 4
> —
> You are receiving this because you are subscribed to this thread.
> Reply to this email directly, view it on GitHub, or unsubscribe.
—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub <#96?email_source=notifications&email_token=AFH7LI6FW6K4YJSGMBFULPDQSMQJBA5CNFSM4JJ4BYN2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEDH2XZQ#issuecomment-550480870>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AFH7LI6V5DM277JMJ3YQVS3QSMQJBANCNFSM4JJ4BYNQ>.
|
|
@DeafEyeJedi not at all – we really appreciate input from the community, and in fact Riley, Matt, and I are all working together to fix this. This error entails an entire rewrite of the authentication mechanism to simulate AuthKit, which hasn’t ever been done before (at least publicly). Cydia Impactor is also currently broken for the same reason. |
|
Is there a different channel where things are being discussed? |
|
@kabiroberai , The host machine's information(MLB,ROM, hardware model,os) gathering is happening in the AuthKit framework of the local process, not on the |
|
@TrungNguyen1909 Do you have solve it ? Do you have any demo? |
You will also need You can run a patched No, I don't have any demo tbh. Although I can still sideload apps from my Mac to my iPhone using Xcode(create a project with a bundle ID,...etc) & iOS App Signer, It's still impractical because reliance on AuthKit makes sideloading from Windows sounds impossible |
|
|
|
Appreciate all the research and work you guys do. Maybe have some hardcoded headers is good enough? |
Anything else? guys? |
|
Recently authenticated, could now fetch teams, certificates. Apple API Calls are working. Trying to build ReProvision but stuck at this error: Can't build for iOS Sorry My bad, got it now. By the way, I used AuthKitUI to login, which meant we can only get the token, not the real password. |
|
On Sat, 9 Nov 2019, esterTion wrote:
...
(Not to mention unc0ver causes kernel panic almost once a day)
Is this a known issue? Currently should be running something like 3.7.0~b1 with no stability issues, even tough the device slows down a little bit but I am convinced it's not related to unc0ver itself.
… Maybe have some hardcoded headers is good enough?
If you guys want to perfect it before release, I can totally understand that. 😄
—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub, or unsubscribe.[AEA6HOOEQZIXIVK6WECVE2LQS6DXRA5CNFSM4JJ4BYN2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEDUU7RI.gif]
|
Well, my phone always just freeze to death, or the substrate simply stoped working, neither did MTerminal. ( tweak not injecting and terminal with [Killed 9] ) I also switch between 3.7b3 & 3.5.2, nothing is fixed, still either lose jailbreak or freeze, thus forcing me to reboot. |
|
On Sun, 10 Nov 2019, esterTion wrote:
Well, my phone always just freeze to death, or the substrate simply stoped working, neither did MTerminal. ( tweak not injecting and terminal with [Killed 9] )
I feel like kernel is messed up somehow, but not sure where.
Hope you can solve your problem; maybe a bad extension is active? Does using Safe Mode help in this respect?
|
|
Well, when it dies there’s nothing to rescue. ( also this seems out of topic in this issue🤔) |
|
Fixed, Got ReProvision working. Still need some cleanup, PR soon... |
Very much appreciated! I do want to refactor EEAppleServices for setting headers on a request, so will wait until you’re done. |
If the code to sign in doesn't require JB, the authentication could be done on iOS and the token sent to a desktop app. |
|
Idea: is it possible to patch akd so that the certificate chain is not validated and look at the HTTPS traffic? |
|
My code uses AuthKit heavily, which required both an Apple device and jailbreak. Unfortunately, on macOS, SIP disabled for amfid patch is required. Partial/full reverse engineering of AuthKit is required for Windows & SIP-enabled Macs |
|
@TrungNguyen1909 Awesome, Wating your PR. |
|
@aovestdipaperino Yes indeed it is! You can swizzle |
|
Pull Request opened. |
|
so I haven't really paid attention to this and y'all may already be to the point where this is not helpful, but there's a macOS CLI tool, xcode-install which is basically a tool that lets you manage Xcode and command line tools versions on your Mac via terminal During the install process, it requests you log in with an Apple ID/password, and if you have 2FA, it actually lets you input a 2FA code (directly into stdin) instead of requiring an app-specific password I have no technical information about how this works, and given that a temporary workaround already seems to be in the works, that might be useless for y'all, but I figured it was worth mentioning. |
|
@Samgisaninja xcode-install appears to use fastlane, which uses Apple's web auth API ( |
|
I see that reprovision is working, amazing job! But as for some or many of us, we depend on windows cydia impactor. Any new info on it? We appreciate all the work & time put in! @rileytestut @TrungNguyen1909 |
We use macOS so we can't help you with your Windows problem. |
|
got Unknown error when login with an appleid on jailbreak device.
|
|
Hello Guys, |
Hi, |
I had ReProvision, as now my device is unjailbroken I cannot access the app. Is there any other way I can access ReProvision while my device is unjailbroken or side load ReProvision again somehow. |
|
You’ll have to rejailbreak with using uncover from OTA downloads (and then go into cydia to update ReProvision.
Once that’s done, then you can re-download from uncover website directly which then will prompt you w a window to allow for install via ReProvision.
Also I noticed with the latest ReProvision you will need to log in with normal AppleID and normal password. Not the app-specific password as it used to be. Just beware.
…-Sean
Sent from my iPhone XR
On Nov 18, 2019, at 3:14 PM, SarveshAj420 ***@***.***> wrote:
Hello Guys,
I have an Iphone XS IOS 12.2. It was jailbroken for a long time and now I am missing it as I am repeatedly getting the error "Please update to Xcode 7.3 or later to continue developing with your Apple ID", whenever i try to jailbreak it. I normally use Cydia Impactor on Mac and also had Reprovision but due to this problem none are working and I am not being able to jailbreak my phone. Can anybody please help me out !!!........
Hi,
Are you running the latest version of ReProvision? It is working for me.
As for cydia impactor, I think it is broken at the moment as far as I know.
I had ReProvision, as now my device is unjailbroken I cannot access the app. Is there any other way I can access ReProvision while my device is unjailbroken or side load ReProvision again somehow.
—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub, or unsubscribe.
|
|
Here’s a screen record of what you can do after you JB again...
…Sent from my iPhone XR
On Nov 18, 2019, at 3:14 PM, SarveshAj420 ***@***.***> wrote:
Hello Guys,
I have an Iphone XS IOS 12.2. It was jailbroken for a long time and now I am missing it as I am repeatedly getting the error "Please update to Xcode 7.3 or later to continue developing with your Apple ID", whenever i try to jailbreak it. I normally use Cydia Impactor on Mac and also had Reprovision but due to this problem none are working and I am not being able to jailbreak my phone. Can anybody please help me out !!!........
Hi,
Are you running the latest version of ReProvision? It is working for me.
As for cydia impactor, I think it is broken at the moment as far as I know.
I had ReProvision, as now my device is unjailbroken I cannot access the app. Is there any other way I can access ReProvision while my device is unjailbroken or side load ReProvision again somehow.
—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub, or unsubscribe.
|
Sorry but can you please help me on how to rejailbreak using uncover from OTA downloads |
If you have a mac, you can follow this to resign uncover or chirema. https://www.reddit.com/r/jailbreak/comments/dw3z3g/news_workaround_for_impactor_xcode_73_error/ |
Is there a web version of the login interface resolution? |
|
spaceship has API for apple auth, why not use it? |
|
Sorry for the off topic but...
REPROVISION, Error, updateCurrentTeamIDWithCompletionHandler: No Team ID present! This is *really* bad.
|
|
This particular issue is now resolved. Anything that is NOT related to "Update to Xcode 7.3" should be redirected to a different issues. |
Describe the bug
I cannot sign the IPA for h3lix jailbreak. When at 30%, it gives the following error message:
submitDevelopmentCSR: Please update to Xcode 7.3 or later to continue developing with your Apple ID.
I don't know if this also happens with other apps.
To Reproduce
Steps to reproduce the behavior:
Expected behavior
The app to be resigned.
Screenshots
Device (please complete the following information):
The text was updated successfully, but these errors were encountered: