iTunes App Store Hacking

Last night, I tried to figure out how the iTunes App Store (as accessed from the iPod Touch) worked.
I was able to simulate the app store experience, and here are the few notes I took on the matter.

All replies from the App Store are gzip-compressed.
If any of these steps fails, the connection is terminated.

1. The device queries phobos.apple.com for a "bag" (ix=2), which contains a signature and a signing key.
2. The device sends a non-binary plist (XML property list) of its current applications to a WebObject called "availableSoftwareUpgrades"
3. The app store replies with a list of all the information for those applications. It is up to the iPod itself to determine whether/not there are upgrades.
4. Periodically, the device makes a request to metrics.apple.com (which replies 100 Continue instead of 200 OK), which I believe is for stats tracking.
5. The device reads software categories and loads icons (WebObject viewFeaturedSoftwareCategories)
6. The device loads the contents of a category (WebObject viewGenre)
7. The device loads an application's information descriptor (WebObject viewSoftware). This for some reason contains the text to be used in the price display, as well as the "INSTALL" or "BUY NOW" text.
8. The device initiated a secure connection to download an application. This is where I had to stop my research, as I couldn't track this.

Tools used:

• curl (Commandline URL Fetcher)
• Wireshark (packet capturer/analyzer)
• Apache (Web Server, used here to serve fake App Ptore pages)
• A single firewall rule on my router to redirect all traffic coming from the iPod back to my computer (iptables -t nat -A PREROUTING -s ipod -p tcp -j DNAT --to 192.168.254.1. Note: I couldn't redirect to a computer inside the router's network, so I had to hook up via WiFi to the router AND via Ethernet to the modem)

Not much useful information into the app loading process was gleaned from this, unfortunately, though I did manage to snap some "neat" screenshots of my meddling.


Applications are signed, though, so even if this was an exploitable vector, the device would need to be jailbroken first, thus making this useless.
Neat nonetheless.

Total: ∞ packages (0 good luck, 1 mistake)

I'd just like to put this out there for everybody...

1. Make frequent backups. Maybe every month.
2. Do not, under ANY circumstances, accidentally try to install Haiku to /dev/sda. Ever.

Now that the advice is out of the way, it's story time!

Yesterday, I was trying to install Haiku to my 512MB flash drive, which, when I plugged it in, got assigned /dev/sdb. The Haiku build system was, at the time set to write to /dev/sda2 (my 3GiB Haiku partition). I deleted the "2" and went on with my business. I ran jam -q haiku-image to build it.
"Hmm, this is taking a while."
"dd, wrote 134 MB to /dev/sda"
"/dev/sda?! WHAT?!"
"OH MY GOD!"

It wrote 134 MB of 0x00s to the beginning of my hard drive, clobbering the bootloader, partition table, and the root filesystem of my Linux installation (/dev/sda1).

It also got to the "Populating Image" step, so it was happily chugging along writing a Be File System over my entire hard drive and filling it with Haiku data.
^C!

Programs still ran, not all the files on / were lost, and I was in a state of panic.
One reboot later confirmed the obvious - no more system. Also, no more files in /. The filesystem layout was in memory, and I should have taken the time to recover some of the data before I reformatted.

fsck told me that /usr was trashed.. /usr is like "Program Files" and more for Linux... Random data written in random places on a volume is... bad ;)
/ was definitely a goner...
/home somehow survived, guaranteeing that my 8 years-worth of data would stick around for a while longer!
Fortunately, I had backups from August 15th!
Unfortunately, they were from August 15th. That means 3 months worth of upgrades to do...

Restored / and /usr, some of /var (installed package database only), and went to work upgrading.

500 compiled and installed packages later (the last of which are still going) and Jesus is... Well, for the situation, I have to say he's done pretty darn well. Kudos, me.

Once this is all done?

BACKUP TIME!

I think I need a NOS.

Vista Woes Pt. II; What gives?

Getting wireless working in vista sucks. I'd rather BITE MY OWN ARM OFF. What gives?
Getting vista to accept a non-signed device driver sucks. What gives?
Getting the Group Policy editor to work sucked (had to remove system policy file).
I was running on battery power until my computer died, and vista never even told me.
It just sat there and then shut off, degrading the capacity of my battery further. What gives?
30 GB volume, I barely have anything on it and it's got 10 GB free. What gives?
Right this moment I have a restart pending for reconfiguration and a program that says "Cancel pending.. Please wait.. This may take several minutes. Please do not exit from this operation." (Not like I can exit, or anything.) What gives?
Installing the windows update for my video card caused it to shut off and not start up anymore: boot = windows failure = poweroff. Safe mode to the rescue. What gives?

Point of Note: I still don't have wireless working. At all. It connects to my router, and that's it. Its dumb ass can't get an address from DHCP, when everything else (including older versions of Windows) can.

I choose Bite my Own Arm Off. It really would be less painful and time-consuming.

I believe I've restarted this thing 30 times in configuration.

For some reason, Vista boots through GRUB?
Not even kidding. My Grub -> Vista GRLDR -> Vista BootMgr.
I don't remember installing that. Is that legal?
It appears GRLDR is a giant GRUB binary. It contains the stage1, stage2, every stage1.5 AND a menu.lst configuration file, all in one. Neat.

Anyway, I'm staying up all night or something.