{"id":18292081,"url":"https://github.com/seemoo-lab/aristoteles","last_synced_at":"2025-04-05T10:31:08.086Z","repository":{"id":47253794,"uuid":"391738404","full_name":"seemoo-lab/aristoteles","owner":"seemoo-lab","description":"A Wireshark dissector for the Apple Remote Invocation (ARI) protocol, used between Intel base band chips and the iOS CommCenter for various management purposes, SMS, telephony and much more.","archived":false,"fork":false,"pushed_at":"2025-03-13T18:53:16.000Z","size":413,"stargazers_count":52,"open_issues_count":1,"forks_count":7,"subscribers_count":10,"default_branch":"master","last_synced_at":"2025-04-05T05:34:50.797Z","etag":null,"topics":["apple","dissector","frida","ghidra","wireshark","wireshark-dissector"],"latest_commit_sha":null,"homepage":"","language":"Lua","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/seemoo-lab.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2021-08-01T21:05:17.000Z","updated_at":"2025-03-13T18:53:07.000Z","dependencies_parsed_at":"2022-09-22T21:40:45.942Z","dependency_job_id":null,"html_url":"https://github.com/seemoo-lab/aristoteles","commit_stats":null,"previous_names":[],"tags_count":2,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/seemoo-lab%2Faristoteles","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/seemoo-lab%2Faristoteles/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/seemoo-lab%2Faristoteles/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/seemoo-lab%2Faristoteles/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/seemoo-lab","download_url":"https://codeload.github.com/seemoo-lab/aristoteles/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247324602,"owners_count":20920679,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["apple","dissector","frida","ghidra","wireshark","wireshark-dissector"],"created_at":"2024-11-05T14:16:32.433Z","updated_at":"2025-04-05T10:31:08.071Z","avatar_url":"https://github.com/seemoo-lab.png","language":"Lua","funding_links":[],"categories":[],"sub_categories":[],"readme":"\u003cdiv align=\"center\"\u003e\n    \u003cbr\u003e\u003cbr\u003e\n    \u003cimg src=\"assets/logo.png\" alt=\"ARIstoteles logo\" width=\"50%\"\u003e\n    \u003cbr\u003e\n    ARI - Wireshark - Dissector\n    \u003cbr\u003e\n    \u003cbr\u003e\n    \u003chr\u003e\n\u003c/div\u003e\n\nThis repo contains a Wireshark dissector for the Apple Remote Invocation (ARI) protocol, used between Intel baseband chips and the\niOS CommCenter for various management purposes, SMS, telephony and much more. Since it is a management interface, some\ninformation is using other interfaces, such as audio from calls or network traffic.\nOnly Intel basebands support ARI, Qualcomm basebands use QMI.\nSome iPhones were produced with both chip flavors, depending on the region. These\nscripts were tested on an iPhone 11, SE 2020, 8, and 7. The iPhone 12 is Qualcomm only, even though Apple acquired\nthe baseband division of Intel recently. More information what ARI does can be found in the rC3 talk\n[Fuzzing the phone in the iPhone](https://media.ccc.de/v/rc3-11358-fuzzing_the_phone_in_the_iphone)\nas well as our ESORICS paper _ARIstoteles - Dissecting Apple's Baseband Interface_.\nAfter successful installation and packet capture, the output looks as follows:\n\n![SMS](assets/wireshark_sms.png)\n\n## Installation\n\n1. Clone this repository into your Wireshark plugin folder `~/.local/lib/wireshark/plugins/` (on Linux) or `%APPDATA%\\Wireshark\\plugins\\` (on Windows) and restart Wireshark.  \n   Can also be copied to a subfolder with the exact Wireshark version, i.e., `~/.local/lib/wireshark/plugins/3.4/`.  \n   For more information visit the [Wireshark documentation](https://www.wireshark.org/docs/wsug_html_chunked/ChPluginFolders.html).\n2. Go to `Edit -\u003e Preferences... -\u003e Protocols -\u003e DLT_USER -\u003e Edit` and press the \"+\" button to add a mapping for USER 0 (DLT=147) with the payload protocol `ari`.  \n   If this is already mapped, you may also choose any other ID and it should work (untested) by replacing `USER_0` with your mapping in the following sections.\n3. All set! Let's start dissecting some ARI packets!\n\nTested on Wireshark v3.6.0 with Lua 5.2.4.\n\nCurrently contains extracted types and information from iOS version: 18.3.1\n\n## Usage\n\n### Watch ARI messages on an iPhone\n\nThe [tools/](tools/) folder contains the [`watch_syslog.py`](tools/watch_syslog.py) to capture packets from\n`idevicesyslog` output (no jailbreak required) as well as the\n[`watch_frida.py`](tools/watch_frida.py) script that captures them by hooking `CommCenter` with Frida (jailbreak required).\nThe packets will be shown in Wireshark and you can record and save the trace, if needed.\n\n```\n   cd tools\n   python watch_syslog.py\n   python watch_frida.py\n```\n\nThe scripts will automatically try to start an `idevicesyslog` process or Frida script on the iPhone and a Wireshark\nprocess. Attack your iPhone while running the script - ideally only one iPhone - and mutually trust it.\nUsually, the `idevicesyslog` output is stripped, but after installing the\n[Baseband Debug Profile](https://developer.apple.com/bug-reporting/profiles-and-logs/) on a non-jailbroken device\nARI messages become visible. The baseband debug profile expires after 21 days, but it can be re-installed afterwards.\n\n**Notice: Due to all data being sent back to the scripts the performance might be slow on high traffic but does usually\nnot cause any problems.**\n\n**Notice: The Frida version does currently output ARI messages sent to the baseband with a sequence number of 0\nand does not include the correct value since the method does not receive the correct sequence number.**\n\n### Importing data from a raw packet trace\n\nAnother packet format are separate files per packet. This might be the case for a fuzzing corpus or some of the\nexamples provided here. Instead of watching packets live on an iPhone, such files have to be concatenated into a\nsingle binary file and then opened in Wireshark. Since Wireshark does not know the packet type, this has to be added\nmanually.\n\n1. Convert your ARI binary trace to a single hexdump, for example using our [`corpus_concat_hexdump.sh`](tools/corpus_concat_hexdump.sh)\n   script, found in the [tools/](tools) folder.  \n   `corpus_concat_hexdump.sh trace_folder/ trace.hd`.\n2. Open a hexdump via `File -\u003e Import from Hex Dump...`.\n3. Choose `USER_0` as the `Encapsulation Type`.\n\n![Import](assets/wireshark_import.png)\n\n### Inject ARI messages into an iPhone\n\nThe scripts [`inject_custom_packet.py`](tools/inject_custom_packet.py) and [`replay_custom_packet.py`](tools/replay_custom_packet.py)\ncan inject or replay custom payloads. This might be interesting for fuzzing and other testing purposes, such as instrumenting\nthe baseband chip. Injection works using Frida, meaning that these scripts require a jailbreak.\n\n```\n    cd tools\n    python replay_custom_packet.py ../examples/crashes/CellMonitor_1\n```\n\n## Examples\n\n- [examples/crashes](examples/crashes/) contains replayable crashes and bugs. Some of them were fixed in iOS 14.3, some in iOS 14.6.\n  Note that the resulting crash can be different depending on the underlying hardware, e.g., some crashes might only occur\n  on an iPhone 7/8.\n- [examples/captures](examples/captures/) contains a Wireshark trace to test the dissector even without iPhone.\n\n## Developing\n\nSee [DEVELOPING.md](DEVELOPING.md) for details on how to extend the parsers, implementing new ones or even running\nthe provided [Ghidra](https://github.com/NationalSecurityAgency/ghidra) extraction scripts.\n\n## Publications\n\n- [Kröll, Tobias (2021): **\"ARIstoteles: iOS Baseband Interface Protocol Analysis\"**](https://tuprints.ulb.tu-darmstadt.de/id/eprint/19397)  \n   This project was initially developed and documented in the bachelor thesis by Tobias Kröll.\n- [Kröll T., Kleber S., Kargl F., Hollick M., Classen J. (2021): **\"ARIstoteles – Dissecting Apple’s Baseband Interface\"**](https://doi.org/10.1007/978-3-030-88418-5_7)  \n   Our paper about ARI dissection and fuzzing presented at ESORICS 2021.\n\n## License\n\nARIstoteles is open source software released under the MIT license. See [LICENSE](LICENSE) for more information.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fseemoo-lab%2Faristoteles","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fseemoo-lab%2Faristoteles","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fseemoo-lab%2Faristoteles/lists"}