From d0497fd36cc107ca2e6001a211ec77a4c8160ce8 Mon Sep 17 00:00:00 2001 From: Rick Mark Date: Wed, 5 Aug 2026 22:01:33 -0700 Subject: [PATCH 1/2] PKI OID map --- .rubocop.yml | 2 +- _packages/ruby/lib/apple_data/data_file.rb | 2 +- .../apple_data/dsl/data_file_definition.rb | 20 +++++++++++++------ _packages/ruby/lib/apple_data/schemas/pki.rb | 7 +++++++ spec/apple_data/schemas/pki_spec.rb | 19 ++++++++++++++++++ 5 files changed, 42 insertions(+), 8 deletions(-) create mode 100644 spec/apple_data/schemas/pki_spec.rb diff --git a/.rubocop.yml b/.rubocop.yml index bbc3b8e4..a9c9c064 100644 --- a/.rubocop.yml +++ b/.rubocop.yml @@ -41,7 +41,7 @@ Naming/FileName: Metrics/AbcSize: CountRepeatedAttributes: false - Max: 25 + Max: 30 Metrics/ClassLength: Max: 150 diff --git a/_packages/ruby/lib/apple_data/data_file.rb b/_packages/ruby/lib/apple_data/data_file.rb index a6cf5d1c..6b05cb5b 100644 --- a/_packages/ruby/lib/apple_data/data_file.rb +++ b/_packages/ruby/lib/apple_data/data_file.rb @@ -159,7 +159,7 @@ def construct_hash(collection_definition, value) [key, instance] end - result.to_h + result.to_h.with_indifferent_access end end end diff --git a/_packages/ruby/lib/apple_data/dsl/data_file_definition.rb b/_packages/ruby/lib/apple_data/dsl/data_file_definition.rb index 6842736b..bff7ca2f 100644 --- a/_packages/ruby/lib/apple_data/dsl/data_file_definition.rb +++ b/_packages/ruby/lib/apple_data/dsl/data_file_definition.rb @@ -9,13 +9,21 @@ def initialize @methods = {} end - def collection(name, mapper = nil, &) - @collections[name] = AppleData::DSL::CollectionDefinition.new(name, mapper) - if block_given? && @collections[name].mapper.nil? - @collections[name].mapper = Class.new(AppleData::SchemaBase) - @collections[name].mapper.class_eval(&) + def collection(collection_name, mapper = nil, &) + data_collection_name = self.class.name + @collections[collection_name] = AppleData::DSL::CollectionDefinition.new(collection_name, mapper) + if block_given? && @collections[collection_name].mapper.nil? + @collections[collection_name].mapper = Class.new(AppleData::SchemaBase) + @collections[collection_name].mapper.const_set(:DATA_COLLECTION_NAME, data_collection_name) + @collections[collection_name].mapper.const_set(:COLLECTION_NAME, collection_name) + @collections[collection_name].mapper.instance_eval do + def name + "#{self.class.const_get(:DATA_COLLECTION_NAME)}:#{self.class.const_get(:COLLECTION_NAME)}" + end + end + @collections[collection_name].mapper.class_eval(&) end - @collections[name] + @collections[collection_name] end def define_method(name, &proc) diff --git a/_packages/ruby/lib/apple_data/schemas/pki.rb b/_packages/ruby/lib/apple_data/schemas/pki.rb index a2047ece..68b73c8f 100644 --- a/_packages/ruby/lib/apple_data/schemas/pki.rb +++ b/_packages/ruby/lib/apple_data/schemas/pki.rb @@ -15,6 +15,9 @@ end collection :oids do + attr_accessor :key + + attribute :name, :string attribute :title, :string attribute :type, :string attribute :description, :string @@ -22,5 +25,9 @@ attribute :found_in, :string, collection: true attribute :issuers, :string, collection: true attribute :ous, :string, collection: true + + define_method :to_s do + [name, title, description, key].reject(&:blank?).first + end end end diff --git a/spec/apple_data/schemas/pki_spec.rb b/spec/apple_data/schemas/pki_spec.rb new file mode 100644 index 00000000..6aa00142 --- /dev/null +++ b/spec/apple_data/schemas/pki_spec.rb @@ -0,0 +1,19 @@ +# frozen_string_literal: true + +RSpec.describe AppleData::Schemas::PKI do + let(:instance) { described_class.new } + + it 'has entries' do + aggregate_failures do + expect(instance.oids).to be_a(Hash) + expect(instance.oids).not_to be_empty + end + end + + it 'has entries that respond to #to_s' do + aggregate_failures do + expect(instance.oids[:'1.2.840.113635.100.6.1.15'].to_s).to be_a(String) + expect(instance.oids[:'1.2.840.113635.100.6.1.15'].to_s).to eq 'appleImg4Manifest' + end + end +end From 460ccf3cab412a1c0d6233297604c7e7993baa25 Mon Sep 17 00:00:00 2001 From: Rick Mark Date: Thu, 6 Aug 2026 02:27:10 -0700 Subject: [PATCH 2/2] PKI OID map --- .idea/apple-knowledge.iml | 1 + .idea/runConfigurations/AppleData_Specs.xml | 1 + _data/img4.yaml | 53 +++++++-------------- _data/pki.yaml | 9 +++- spec/apple_data/schemas/pki_spec.rb | 2 +- 5 files changed, 28 insertions(+), 38 deletions(-) diff --git a/.idea/apple-knowledge.iml b/.idea/apple-knowledge.iml index 966974ca..8fec0f11 100644 --- a/.idea/apple-knowledge.iml +++ b/.idea/apple-knowledge.iml @@ -34,6 +34,7 @@ + diff --git a/.idea/runConfigurations/AppleData_Specs.xml b/.idea/runConfigurations/AppleData_Specs.xml index ff1cf8d5..86043381 100644 --- a/.idea/runConfigurations/AppleData_Specs.xml +++ b/.idea/runConfigurations/AppleData_Specs.xml @@ -9,6 +9,7 @@ + diff --git a/_data/img4.yaml b/_data/img4.yaml index a7503f66..2f5b7af7 100644 --- a/_data/img4.yaml +++ b/_data/img4.yaml @@ -173,24 +173,6 @@ types: with a `secb` object with a `trst` object), `rssl` (Factory SSL root CA), `rvok` (Revocation list) and `trpk` (trusted public keys?) lpol_properties: - AMNM: - BNCH: - BORD: - CEPO: - CHIP: - CPRO: - CSEC: - DGST: - title: Hash Digest - DPRO: - DSEC: - ECID: - EPRO: - ESEC: - LCST: - LNCH: - RNCH: - SDOM: auxi: title: Auxiliary Image4 Manifest Hash (`auxi`) description: After the system verifies that the UAKL hash matches what’s found @@ -241,11 +223,6 @@ lpol_properties: access: write: - macOS - bat0: - bat1: - batf: - chg0: - chg1: coih: title: CustomOS Image4 Manifest Hash (coih) description: The `coih` is an SHA384 hash of CustomOS Image4 manifest. The payload @@ -257,12 +234,8 @@ lpol_properties: access: write: - 1TR - diag: - dtre: gaid: description: Gaia Authentication ID (Apple Internal) - glyc: - glyp: hrlp: title: Has recoveryOS Local Policy description: The `hrlp` indicates whether or not the `prot` value is the measurement @@ -275,9 +248,6 @@ lpol_properties: - 1TR - recoveryOS - macOS - ibot: - illb: - krnl: kuid: title: Key Encryption Key description: The kuid indicates the volume that was booted. The key encryption @@ -296,7 +266,6 @@ lpol_properties: description: Local Boot Object. Indicates that the object is to be used as the target of a local boot only and not provided by the server for remote / DFU boots. - logo: lpnh: title: LocalPolicy Nonce Hash description: The lpnh is used for anti-replay of the LocalPolicy. This is an SHA384 @@ -357,7 +326,6 @@ lpol_properties: - 1TR - recoveryOS - macOS - recm: rolp: description: recoveryOS local policy type: boolean @@ -392,8 +360,6 @@ lpol_properties: - 1TR - recoveryOS - macOS - rsep: - sepi: sip0: title: System Integrity Protection (SIP) 0 Status - Overall description: The sip0 holds the existing System Integrity Protection (SIP) policy @@ -433,7 +399,6 @@ lpol_properties: description: Secure Multi-Boot 3 - DEP-allowed MDM Control smb5: description: Unknown - but known to exist in Factory signing - snon: snuf: description: Staged Nonce For Update Firmware spih: @@ -656,6 +621,9 @@ manifest_properties: description: Local Policy Next Cryptographic Hash name: ApLocalNonceHash Mod#: + title: Model ID + mlb#: + title: Main Logic Board Serial RNCH: description: Remote Nonce Cryptographic Hash RSCH: @@ -762,6 +730,7 @@ manifest_properties: Potentially indicates that the policy is for a recovery boot only. type: boolean rfcg: + title: Reconfigure Mode type: boolean rsch: description: research mode @@ -803,8 +772,12 @@ manifest_properties: name: Ap,TargetType roots: - ManifestKey-DataCenter + META: + title: Metadata + SPAY: + title: SysCfg Payload uidm: - description: UID Mode (Enabled) + description: UID Mixing (Entanglement) type: boolean roots: - ManifestKey-DataCenter @@ -1121,6 +1094,8 @@ img4_tags: title: Charger Input Limit Calibration CLHS: description: Chained LocalPolicy Hash String + SDOM: + title: Security Domain Coor: title: Country of Origin DPCl: @@ -1158,6 +1133,8 @@ img4_tags: title: Proximity Calibration Data RMd#: title: Regional Model Number + DGST: + title: Object Digest SPTM: description: Secure Page Table Monitor SpTS: @@ -1194,10 +1171,14 @@ img4_tags: auac: description: batf: + title: Battery Firmware berb: + time: + title: Timestamp bles: description: cfel: + title: CFELoader description: firmware_name: CFELoader cker: diff --git a/_data/pki.yaml b/_data/pki.yaml index 210857aa..faf2765a 100644 --- a/_data/pki.yaml +++ b/_data/pki.yaml @@ -92,7 +92,7 @@ oids: symbol: oidAppleSecureBootTicketCertSpec 1.2.840.113635.100.6.1.15: title: IMG4 Manifest Certificate Specification - name: appleImg4Manifest + name: appleImg4ManifestSpecification type: sequence description: "Constriction on values that can be specified or signed by this certificate. \ Conatins two sub-sequesnces, \nthe MANP (Manifest Properties) and the OBJP @@ -143,12 +143,16 @@ oids: 1.2.840.113635.100.6.1.4: apple_description: Apple World Wide Developer Relations Certificates for Code Signing GM from developer to Apple + 1.2.840.113635.100.6.8: + name: appleImg4Manifest 1.2.840.113635.100.6.16: + name: appleSecureEnclaveFDRCommands description: A sequence of FDR programming commands, seperated by ";". Each command is "PUT" or "GET" prior to a 4CC value, followed by a ":" then the value of the key. example: PUT/FSCl:sik-FXFYFXFFYFFEX-QQRRRDEETFEFYCEIESLIREILCILESCLSELRESERSER 1.2.840.113635.100.6.17: + name: appleKeyInstanceName description: Contains the name of the key 1.2.840.113635.100.6.2: title: Apple Security Algorithm @@ -158,6 +162,7 @@ oids: 1.2.840.113635.100.6.2.10: symbol: oidAppleIntmMarkerAppleSystemIntg2 1.2.840.113635.100.6.2.12: + name: appleIntmMarkerAppleServerAuthentication symbol: oidAppleIntmMarkerAppleServerAuthentication 1.2.840.113635.100.6.2.13: symbol: oidAppleIntmMarkerAppleSystemIntgG3 @@ -258,6 +263,8 @@ oids: 1.2.840.113635.100.6.71.1: description: Made for iDevice (MFi) - Authentication v4 - Apple Accessory Properties Extension + 1.2.840.113635.100.6.9: + title: appleSomeSHA256Hash 1.2.840.113635.100.7.1.1: apple_description: 'Apple FairPlay certificate extended Application Authentication & Authorization: Policy' diff --git a/spec/apple_data/schemas/pki_spec.rb b/spec/apple_data/schemas/pki_spec.rb index 6aa00142..d903f187 100644 --- a/spec/apple_data/schemas/pki_spec.rb +++ b/spec/apple_data/schemas/pki_spec.rb @@ -13,7 +13,7 @@ it 'has entries that respond to #to_s' do aggregate_failures do expect(instance.oids[:'1.2.840.113635.100.6.1.15'].to_s).to be_a(String) - expect(instance.oids[:'1.2.840.113635.100.6.1.15'].to_s).to eq 'appleImg4Manifest' + expect(instance.oids[:'1.2.840.113635.100.6.1.15'].to_s).to eq 'appleImg4ManifestSpecification' end end end