Providing support for iOS 12 devices

[oct-test]

Recently, I am trying to make modifications to the InflatableDonkey git repo to make it compatible with iOS 11.4+ backups.

So far, I am able to login into the iCloud servers (even for 2FA accounts) and fetch the list of snapshots taken by each device. The code is generating following error when I try to fetch records using "ManifestID":

operationCost: 1
response {
      operationUUID: "3d3aba80-db4c-48e2-8cf2-1e141a1ca7da"
      type: NONE_TYPE
      last: true
    }
    result {
      code: FAILURE
      error {
        serverError {
          type: NOT_FOUND
        }
        errorDescription: "Error code: NOT_FOUND"
        errorKey: "ck1744ip5"
      }
    }

Questions: I would like to understand what the above error exactly represents and which areas I can look to fix this issue?

Please let me know if any more information is required. I would appreciate any suggestions and thoughts on this topic.

Let's make this tool alive again! @horrorho , @Aliasr ,@dirkwirth , @Blokh

[alexicloud]

@oct-test could you please share your knowledge.how you modify your script to run on 2FA accounts. please help me on this.

[Galeneius]

@oct-test , did you generated the 2FA token via webcalls or extracted it from an Manifest.plist? As far as I can see it's like the code expired at some time e.g not valid anymore. Perhaps there is an extra layer in 11.4 backups that prevents the call to fetch the records.

On a similar note, with accounts lower than 11.4 and having 2FA, does your method work? Else if you do not have such a test case can I perhaps try it out? Sitting on 10.X version, but with 2FA, I am not able to download backups either (apprehending the 2FA code with --token does not retrieve the mmauthtoken) so maybe it's a globally thing or we can exclude certain things. Please let me know.

[lgrimani]

Hi - I have a few questions about iOS12 backups, wondering if anyone here knows.

Does the ManifestKey/BackupKeybag change completely with each incremental differential backup? I tested this a few times and sometimes it doesn't change at all and sometimes some of the contents of the BackupKeybag change but its not clear to me how and when.

Once Manifest.DB is decrypted, does each encrypted file have its own unique key that needs to be generated from each row in the Files table?

Finally, when entries are removed from the Files table, are they removed completely from the SQLite database or is it just hidden by a delete flag (and hence recoverable)?

I am trying to decrypt encrypted files from one backup ago where a newer Manifest.DB/Manifest.plist has overwritten the old one. None of the commercial solutions support this so I've been trying to hack my way through it

Thanks