Add opt-in external anisette providers for Windows authentication

AltServer/AnisetteDataManager.cpp

@@ -10,6 +10,7 @@
 #include <set>
 
 #include "AnisetteData.h"
+#include "ExternalAnisetteData.h"
 #include "AltServerApp.h"
 
 //#define SPOOF_MAC 1
@@ -362,6 +363,12 @@ bool AnisetteDataManager::LoadDependencies()
 
 std::shared_ptr<AnisetteData> AnisetteDataManager::FetchAnisetteData()
 {
+	const auto externalServer = _wgetenv(L"ALTSERVER_ANISETTE_SERVER");
+	if (externalServer != nullptr && *externalServer != L'\0')
+	{
+		return ExternalAnisette::Fetch(externalServer);
+	}
+
 	if (!this->loadedDependencies)
 	{
 		this->LoadDependencies();
@@ -551,6 +558,9 @@ bool AnisetteDataManager::ReprovisionDevice(std::function<void(void)> provisionC
 
 bool AnisetteDataManager::ResetProvisioning()
 {
+	const auto externalServer = _wgetenv(L"ALTSERVER_ANISETTE_SERVER");
+	if (externalServer != nullptr && *externalServer != L'\0') return false;
+
 	std::string adiDirectoryPath = "C:\\ProgramData\\Apple Computer\\iTunes\\adi";
 
 	// Remove existing AltServer .pb files so we can create new ones next time we provision this device.

AltSign/AltSign.vcxproj

@@ -21,6 +21,7 @@
   <ItemGroup>
     <ClCompile Include="Account.cpp" />
     <ClCompile Include="AnisetteData.cpp" />
+    <ClCompile Include="ExternalAnisetteData.cpp" />
     <ClCompile Include="AppGroup.cpp" />
     <ClCompile Include="AppID.cpp" />
     <ClCompile Include="AppleAPI+Authentication.cpp" />
@@ -44,6 +45,7 @@
   <ItemGroup>
     <ClInclude Include="Account.hpp" />
     <ClInclude Include="AnisetteData.h" />
+    <ClInclude Include="ExternalAnisetteData.h" />
     <ClInclude Include="AppGroup.hpp" />
     <ClInclude Include="AppID.hpp" />
     <ClInclude Include="AppleAPI.hpp" />

AltSign/AltSign.vcxproj.filters

@@ -18,6 +18,9 @@
     <ClCompile Include="Account.cpp">
       <Filter>Source Files</Filter>
     </ClCompile>
+    <ClCompile Include="ExternalAnisetteData.cpp">
+      <Filter>Source Files</Filter>
+    </ClCompile>
     <ClCompile Include="AppID.cpp">
       <Filter>Source Files</Filter>
     </ClCompile>
@@ -137,6 +140,9 @@
     <ClInclude Include="AnisetteData.h">
       <Filter>Header Files</Filter>
     </ClInclude>
+    <ClInclude Include="ExternalAnisetteData.h">
+      <Filter>Header Files</Filter>
+    </ClInclude>
     <ClInclude Include="AppleAPISession.h">
       <Filter>Header Files</Filter>
     </ClInclude>

AltSign/AnisetteData.cpp

@@ -8,6 +8,7 @@
 
 #include "AnisetteData.h"
 #include <ostream>
+#include <stdexcept>
 
 extern std::string StringFromWideString(std::wstring wideString);
 extern std::wstring WideStringFromString(std::string string);
@@ -133,6 +134,28 @@ std::string AnisetteData::timeZone() const
 	return _timeZone;
 }
 
+std::optional<std::string> AnisetteData::userAgent() const { return _userAgent; }
+void AnisetteData::setUserAgent(std::string value) { _userAgent = std::move(value); }
+void AnisetteData::setRefreshHandler(std::function<std::shared_ptr<AnisetteData>()> handler)
+{
+	_refreshHandler = std::move(handler);
+}
+
+void AnisetteData::refresh()
+{
+	if (!_refreshHandler) return;
+	auto fresh = _refreshHandler();
+	if (!fresh || fresh->machineID() != _machineID || fresh->localUserID() != _localUserID ||
+		fresh->deviceUniqueIdentifier() != _deviceUniqueIdentifier || fresh->deviceSerialNumber() != _deviceSerialNumber ||
+		fresh->deviceDescription() != _deviceDescription || fresh->userAgent() != _userAgent)
+		throw std::runtime_error("External anisette identity changed during sign-in. Start a new sign-in session.");
+	_oneTimePassword = fresh->oneTimePassword();
+	_routingInfo = fresh->routingInfo();
+	_date = fresh->date();
+	_locale = fresh->locale();
+	_timeZone = fresh->timeZone();
+}
+
 web::json::value AnisetteData::json() const
 {
 	time_t time;

AltSign/AnisetteData.h

@@ -15,6 +15,8 @@
 
 #include <optional>
 #include <string>
+#include <memory>
+#include <functional>
 
 #include <ctime>
 
@@ -47,6 +49,10 @@ class AnisetteData
 	TIMEVAL date() const;
 	std::string locale() const;
 	std::string timeZone() const;
+	std::optional<std::string> userAgent() const;
+	void setUserAgent(std::string userAgent);
+	void setRefreshHandler(std::function<std::shared_ptr<AnisetteData>()> handler);
+	void refresh();
 
 	web::json::value json() const;
 
@@ -63,6 +69,8 @@ class AnisetteData
 	TIMEVAL _date;
 	std::string _locale;
 	std::string _timeZone;
+	std::optional<std::string> _userAgent;
+	std::function<std::shared_ptr<AnisetteData>()> _refreshHandler;
 };
 
 #pragma GCC visibility pop

AltSign/AppleAPI+Authentication.cpp

@@ -565,16 +565,26 @@ pplx::task<std::pair<std::shared_ptr<Account>, std::shared_ptr<AppleAPISession>>
 					char* rawAuthType = nullptr;
 					plist_get_string_val(authTypeNode, &rawAuthType);
 
-					authType = rawAuthType;
+					if (rawAuthType != nullptr)
+					{
+						authType = rawAuthType;
+						free(rawAuthType);
+					}
 				}
 
-				if (authType == "trustedDeviceSecondaryAuth")
+				uint64_t authenticationStatus = 0;
+				auto authenticationStatusNode = plist_dict_get_item(statusDictionary, "hsc");
+				if (authenticationStatusNode && plist_get_node_type(authenticationStatusNode) == PLIST_UINT)
+					plist_get_uint_val(authenticationStatusNode, &authenticationStatus);
+				bool codeAlreadySent = (!authType.has_value() || authType->empty()) && authenticationStatus == 409;
+
+				if (authType == "trustedDeviceSecondaryAuth" || codeAlreadySent)
 				{
 					odslog("Requires trusted device two factor...");
 
 					if (verificationHandler.has_value())
 					{
-						return this->RequestTrustedDeviceTwoFactorCode(adsid, idmsToken, anisetteData, *verificationHandler)
+						return this->RequestTrustedDeviceTwoFactorCode(adsid, idmsToken, anisetteData, *verificationHandler, !codeAlreadySent)
 						.then([=](bool success) {
 							return this->Authenticate(unsanitizedAppleID, password, anisetteData, std::nullopt);
 						});
@@ -756,27 +766,65 @@ pplx::task<std::string> AppleAPI::FetchAuthToken(std::map<std::string, plist_t>
 	});
 }
 
+namespace
+{
+    void CheckAuthenticationHTTPStatus(const http_response& response)
+    {
+        if (response.status_code() < 200 || response.status_code() >= 300)
+            throw LocalizedAPIError((int)APIErrorCode::InvalidResponse,
+                "Apple authentication returned HTTP " + std::to_string(response.status_code()) + ".");
+    }
+
+    void RefreshClientParameters(plist_t dictionary, const std::shared_ptr<AnisetteData>& data)
+    {
+        if (!dictionary || plist_get_node_type(dictionary) != PLIST_DICT) return;
+        auto seconds = (time_t)data->date().tv_sec;
+        struct tm utc;
+        gmtime_s(&utc, &seconds);
+        char timestamp[32];
+        strftime(timestamp, sizeof(timestamp), "%Y-%m-%dT%H:%M:%SZ", &utc);
+        plist_dict_set_item(dictionary, "X-Apple-I-Client-Time", plist_new_string(timestamp));
+        plist_dict_set_item(dictionary, "X-Apple-I-MD", plist_new_string(data->oneTimePassword().c_str()));
+        plist_dict_set_item(dictionary, "X-Apple-I-MD-M", plist_new_string(data->machineID().c_str()));
+        plist_dict_set_item(dictionary, "X-Apple-I-MD-LU", plist_new_string(data->localUserID().c_str()));
+        plist_dict_set_item(dictionary, "X-Apple-I-MD-RINFO", plist_new_uint(data->routingInfo()));
+        plist_dict_set_item(dictionary, "X-Mme-Device-Id", plist_new_string(data->deviceUniqueIdentifier().c_str()));
+        plist_dict_set_item(dictionary, "X-Apple-I-SRL-NO", plist_new_string(data->deviceSerialNumber().c_str()));
+        plist_dict_set_item(dictionary, "X-Apple-Locale", plist_new_string(data->locale().c_str()));
+        plist_dict_set_item(dictionary, "X-Apple-I-TimeZone", plist_new_string(data->timeZone().c_str()));
+        plist_dict_set_item(dictionary, "loc", plist_new_string(data->locale().c_str()));
+    }
+}
+
+web::http::client::http_client AppleAPI::authenticationClient(std::shared_ptr<AnisetteData> anisetteData)
+{
+    if (!anisetteData->userAgent().has_value()) return this->gsaClient();
+    http_client_config config;
+    config.set_timeout(std::chrono::seconds(30));
+    return http_client(U("https://gsa.apple.com"), config);
+}
+
 pplx::task<bool> AppleAPI::RequestTrustedDeviceTwoFactorCode(
 	std::string dsid,
 	std::string idmsToken,
 	std::shared_ptr<AnisetteData> anisetteData,
-	const std::function <pplx::task<std::optional<std::string>>(void)>& verificationHandler)
+	const std::function <pplx::task<std::optional<std::string>>(void)>& verificationHandler,
+	bool requestCode)
 {
 	std::string requestURL = "/auth/verify/trusteddevice";
 	std::string verifyURL = "/grandslam/GsService2/validate";
 
-	auto request = this->MakeTwoFactorCodeRequest(requestURL, dsid, idmsToken, anisetteData);
-
-	auto task = this->gsaClient().request(request)
-		.then([=](http_response response)
-			{
-				return response.content_ready();
-			})
-		.then([=](http_response response)
-			{
-				odslog("Received 2FA response status code: " << response.status_code());
-				return response.extract_vector();
-			})
+	pplx::task<std::vector<unsigned char>> delivery = pplx::task_from_result(std::vector<unsigned char>{});
+	if (requestCode)
+	{
+		auto request = this->MakeTwoFactorCodeRequest(requestURL, dsid, idmsToken, anisetteData);
+		delivery = this->authenticationClient(anisetteData).request(request)
+			.then([](http_response response) { CheckAuthenticationHTTPStatus(response); return response.content_ready(); })
+			.then([](http_response response) { return response.extract_vector(); });
+	}
+	// hsc=409 with no au means Apple has already pushed the code. Do not
+	// request a replacement that would invalidate the code on the user's phone.
+	auto task = delivery
 				.then([=](std::vector<unsigned char> decompressedData)
 					{
 						return verificationHandler();
@@ -791,11 +839,11 @@ pplx::task<bool> AppleAPI::RequestTrustedDeviceTwoFactorCode(
 						auto request = this->MakeTwoFactorCodeRequest(verifyURL, dsid, idmsToken, anisetteData);
 						request.headers().add(L"security-code", WideStringFromString(*verificationCode));
 
-						return this->gsaClient().request(request);
+						return this->authenticationClient(anisetteData).request(request);
 					})
 				.then([=](http_response response)
 					{
-						return response.content_ready();
+						CheckAuthenticationHTTPStatus(response); return response.content_ready();
 					})
 				.then([=](http_response response)
 					{
@@ -890,10 +938,10 @@ pplx::task<bool> AppleAPI::RequestSMSTwoFactorCode(
 	free(bodyXML);
 	plist_free(bodyPlist);
 
-	auto task = this->gsaClient().request(request)
+	auto task = this->authenticationClient(anisetteData).request(request)
 		.then([=](http_response response)
 			{
-				return response.content_ready();
+				CheckAuthenticationHTTPStatus(response); return response.content_ready();
 			})
 		.then([=](http_response response)
 			{
@@ -935,11 +983,11 @@ pplx::task<bool> AppleAPI::RequestSMSTwoFactorCode(
 				free(bodyXML);
 				plist_free(bodyPlist);
 
-				return this->gsaClient().request(request);
+				return this->authenticationClient(anisetteData).request(request);
 			})
 		.then([=](http_response response)
 			{
-				return response.content_ready();
+				CheckAuthenticationHTTPStatus(response); return response.content_ready();
 			})
 		.then([=](http_response response)
 			{
@@ -988,6 +1036,13 @@ pplx::task<std::shared_ptr<Account>> AppleAPI::FetchAccount(std::shared_ptr<Appl
 pplx::task<plist_t> AppleAPI::SendAuthenticationRequest(std::map<std::string, plist_t> requestParameters,
 	std::shared_ptr<AnisetteData> anisetteData)
 {
+	anisetteData->refresh();
+	if (anisetteData->userAgent().has_value())
+	{
+		auto cpd = requestParameters.find("cpd");
+		if (cpd != requestParameters.end()) RefreshClientParameters(cpd->second, anisetteData);
+	}
+
 	auto header = plist_new_dict();
 	plist_dict_set_item(header, "Version", plist_new_string("1.0.1"));
 
@@ -1016,7 +1071,7 @@ pplx::task<plist_t> AppleAPI::SendAuthenticationRequest(std::map<std::string, pl
 		{L"Content-Type", L"text/x-xml-plist"},
 		{L"X-Mme-Client-Info", WideStringFromString(anisetteData->deviceDescription())},
 		{L"Accept", L"*/*"},
-		{L"User-Agent", L"akd/1.0 CFNetwork/978.0.7 Darwin/18.7.0"}
+		{L"User-Agent", WideStringFromString(anisetteData->userAgent().value_or("akd/1.0 CFNetwork/978.0.7 Darwin/18.7.0"))}
 	};
 
 	uri_builder builder(U("/grandslam/GsService2"));
@@ -1035,10 +1090,10 @@ pplx::task<plist_t> AppleAPI::SendAuthenticationRequest(std::map<std::string, pl
 		request.headers().add(pair.first, pair.second);
 	}
 
-	auto task = this->gsaClient().request(request)
+	auto task = this->authenticationClient(anisetteData).request(request)
 		.then([=](http_response response)
 			{
-				return response.content_ready();
+				CheckAuthenticationHTTPStatus(response); return response.content_ready();
 			})
 		.then([=](http_response response)
 			{
@@ -1153,6 +1208,8 @@ web::http::http_request AppleAPI::MakeTwoFactorCodeRequest(
 	std::string idmsToken,
 	std::shared_ptr<AnisetteData> anisetteData)
 {
+	anisetteData->refresh();
+
 	auto encodedURI = web::uri::encode_uri(WideStringFromString(url));
 	uri_builder builder(encodedURI);
 
@@ -1168,15 +1225,23 @@ web::http::http_request AppleAPI::MakeTwoFactorCodeRequest(
 	char dateString[64];
 
 	time = anisetteData->date().tv_sec;
-	tm = localtime(&time);
-
-	strftime(dateString, sizeof dateString, "%FT%T%z", tm);
+	struct tm providerTime;
+	if (anisetteData->userAgent().has_value())
+	{
+		gmtime_s(&providerTime, &time);
+		strftime(dateString, sizeof dateString, "%Y-%m-%dT%H:%M:%SZ", &providerTime);
+	}
+	else
+	{
+		tm = localtime(&time);
+		strftime(dateString, sizeof dateString, "%FT%T%z", tm);
+	}
 
 	std::map<utility::string_t, utility::string_t> headers = {
 		{L"Accept", L"application/x-buddyml"},
 		{L"Accept-Language", L"en-us"},
 		{L"Content-Type", L"application/x-plist"},
-		{L"User-Agent", L"Xcode"},
+		{L"User-Agent", WideStringFromString(anisetteData->userAgent().value_or("Xcode"))},
 		{L"X-Apple-App-Info", L"com.apple.gs.xcode.auth"},
 		{L"X-Xcode-Version", L"11.2 (11B41)"},
 

AltSign/AppleAPI.hpp

@@ -75,6 +75,7 @@ class AppleAPI
 
 	web::http::client::http_client _gsaClient;
 	web::http::client::http_client gsaClient();
+	web::http::client::http_client authenticationClient(std::shared_ptr<AnisetteData> anisetteData);
 
     web::http::client::http_client _client;
     web::http::client::http_client client();
@@ -105,7 +106,8 @@ class AppleAPI
 		std::string dsid,
 		std::string idmsToken,
 		std::shared_ptr<AnisetteData> anisetteData,
-		const std::function <pplx::task<std::optional<std::string>>(void)>& verificationHandler);
+		const std::function <pplx::task<std::optional<std::string>>(void)>& verificationHandler,
+		bool requestCode = true);
 
 	pplx::task<bool> RequestSMSTwoFactorCode(
 		std::string dsid,