eep357 Posted January 4, 2013 Share Posted January 4, 2013 Anything's possible, if all the variables are right. I did a quick proxy through my old MacBook using it's extracted certs and was able to alter the iMessage connection routine where it fist connected to http://init.ess.apple.com/WebObjects/VCInit.woa/wa/getBag?ix=1 just as iOS would. It then connected to verisign at which point it failed with "check network connection it may be down", this was likely do to some misconfiguration on my part and I knew I hadn't set everything needed up, but just wanted to see if anything changed. Using mitmproxy to monitor and will be using pushproxy to handle certs, both available on github by meeee. Link to comment Share on other sites More sharing options...
salado Posted January 6, 2013 Share Posted January 6, 2013 Any update or fix for the Message login problem now? Just installed with iATKOS ML2. iCloud and App Store logged-in without problem. No luck on Message App. Ehhh~~~ Link to comment Share on other sites More sharing options...
eep357 Posted January 6, 2013 Share Posted January 6, 2013 Everyone figured out how to fix it on there own so we killed the thread JK. I've been trying different random things as they occur to me, but nothing new worthy of reporting on. Assume that's kinda the case for everyone at the moment. Don't worry, any major revelations will be posted. I did get the beta to reinstall on my Lion only MacBook by changing the system clock and putting it back to internet time after rebooting launching it. Can use it for google talk, but I know if I quit it I'll be forced to switch to iChat next time I launch it. It still can't sign into imessage, gets same "imessage beta has ended" in the auth token response as ML hack and follows the same server authentication sequence as ML on hack, except it does a "get bag" exchange at the beginning like iOS does and the content in it is much longer than what's in the nvram, so at best that is just one portion of it. In the mean time, trying out some Cydia tweaks so I can just use my iOS version from my Hack, or in this case old MacBook. Sorry about the squiggles. Had to protect other peoples privacy. 1 Link to comment Share on other sites More sharing options...
rcork Posted January 6, 2013 Share Posted January 6, 2013 Same as eep357. I've been trying a few things but so far no success to report back on. I did file a support request with VMWare as this problem affects virtualized OSX under Fusion which is a supported configuration by VMWare and Apple. At first they pointed the finger to Apple but after calling BS, they escalated to an engineer who is "looking into it". If VMWare can find and fix the issue we may be able to replicate what they do. I would suggest other paying customers of VMWare Fusion file support requests to bring more attention to the issue. Just don't mention this problem affects hacks since they'll probably deny the request instantly as an unsupported host configuration. It would also be helpful to have a real mac that you run Fusion on in order to work with support and provide any needed info from a legit mac. 3 Link to comment Share on other sites More sharing options...
eep357 Posted January 7, 2013 Share Posted January 7, 2013 Here's my solution: Not perfect and won't work for everyone. You need a jailbroken iOS device. Download and run "Remote Messages" from cydia. I only have iPad it it's iPhone only, had to download from Mac and transfer it via SFTP then use iFile to install. Once installed and enabled in settings, you can use any web browser on your local network to use iMessage. This also lets me use it on my Lion only MacBook and could use it on Windows if I used Windows. Not a fix, but a good enough work around for me at the moment assuming it all works like it should. 2 Link to comment Share on other sites More sharing options...
ZackehSoul Posted January 7, 2013 Share Posted January 7, 2013 Same as eep357. I've been trying a few things but so far no success to report back on. I did file a support request with VMWare as this problem affects virtualized OSX under Fusion which is a supported configuration by VMWare and Apple. At first they pointed the finger to Apple but after calling BS, they escalated to an engineer who is "looking into it". If VMWare can find and fix the issue we may be able to replicate what they do. I would suggest other paying customers of VMWare Fusion file support requests to bring more attention to the issue. Just don't mention this problem affects hacks since they'll probably deny the request instantly as an unsupported host configuration. It would also be helpful to have a real mac that you run Fusion on in order to work with support and provide any needed info from a legit mac. The only thing we gotta hope for there is that they come up with something that fixes it across all platforms and not just localized to VMware. Which knowing the way they work is probably how it'll go. Link to comment Share on other sites More sharing options...
mendietinha Posted January 7, 2013 Share Posted January 7, 2013 i miss it. Link to comment Share on other sites More sharing options...
eep357 Posted January 7, 2013 Share Posted January 7, 2013 With addition of NotifyPro also from Cydia and Growl on Mac, get native message notifications too. Remote Message can do browser notifications. iPad can be locked with screen off and all still works fine. So far so good. Link to comment Share on other sites More sharing options...
sekmo Posted January 7, 2013 Share Posted January 7, 2013 Have anybody tested imessage enabler? It sasys "enable imessage on hackintosh or vmware" http://www.souldevte...-on-hackintosh/ ... and there is also this guide http://www.souldevteam.net/blog/2012/10/05/enabling-imessage-in-vmware-images/ As I come back home I will test it :-) Link to comment Share on other sites More sharing options...
iBlacky Posted January 7, 2013 Share Posted January 7, 2013 Have anybody tested imessage enabler? It sasys "enable imessage on hackintosh or vmware" http://www.souldevte...-on-hackintosh/ ... and there is also this guide http://www.souldevte...-vmware-images/ As I come back home I will test it :-) Update #2: Apple has (inadvertently, I think) stopped the iMessage Enabler from working currently when they performed maintenance on the 18th December. Currently I’m not sure what the issue is but I’ll look into it. Those of you who are already logged in should stay logged in. If you stay logged in you can still access iMessage. Link to comment Share on other sites More sharing options...
cosmo1t Posted January 7, 2013 Share Posted January 7, 2013 1/7/13 8:52:46.979 AM imagent[286]: [Warning] +[iMDMacOSCertificateHandlers generateCSRForPublicKey:privateKey:tpHandle:clHandle:subjectInfo:error:]: createCertCsr() result: -2147418032 1/7/13 8:52:47.012 AM imagent[286]: [Warning] Warning, missing csr in (null) 1/7/13 8:52:47.012 AM imagent[286]: [Warning] Missing message key: csr (Message: <FTProvisionMessage: 0x7fb9d3c44b70>) anyone thats signed in, what is the subject info on any of the imessage certs? Link to comment Share on other sites More sharing options...
fffeee Posted January 7, 2013 Share Posted January 7, 2013 The only thing we gotta hope for there is that they come up with something that fixes it across all platforms and not just localized to VMware. Which knowing the way they work is probably how it'll go. How could they fix it, but only for VMware? They'll need to expose the method used to get values from NVRAM. 1/7/13 8:52:46.979 AM imagent[286]: [Warning] +[iMDMacOSCertificateHandlers generateCSRForPublicKey:privateKey:tpHandle:clHandle:subjectInfo:error:]: createCertCsr() result: -2147418032 1/7/13 8:52:47.012 AM imagent[286]: [Warning] Warning, missing csr in (null) 1/7/13 8:52:47.012 AM imagent[286]: [Warning] Missing message key: csr (Message: <FTProvisionMessage: 0x7fb9d3c44b70>) anyone thats signed in, what is the subject info on any of the imessage certs? We're past the certificates at this point. Link to comment Share on other sites More sharing options...
cosmo1t Posted January 7, 2013 Share Posted January 7, 2013 glad you're past that. when you have it fixed let me know so i can make the commit to chameleon. we've discussed NVRAM stuff in the bootloader for a while.. this may be a reson for doing it, or at least for developing a real kext to handle it.. i sitll think the bootloader will have some responsibility at startup to load the saved data (unless the os doesn't require any of the data until userland is fired up) Link to comment Share on other sites More sharing options...
fffeee Posted January 7, 2013 Share Posted January 7, 2013 I did file a support request with VMWare as this problem affects virtualized OSX under Fusion which is a supported configuration by VMWare and Apple. Good suggestion, I did the same. I'll escalate it on the enterprise support side if they are non-responsive. glad you're past that. when you have it fixed let me know so i can make the commit to chameleon. Are you wanting to do this at the boot loader or do you think it should happen in userland? Does anyone know if the code revogirl was working on for semi-persistant values is in a usable state and worth using for this? I likely misunderstood where you were going with the certificate query, the "beta" iMessage conversation does things out of order, but are you wondering if there is a CSR value that is being stored to NVRAM or something? Link to comment Share on other sites More sharing options...
rcork Posted January 7, 2013 Share Posted January 7, 2013 Good suggestion, I did the same. I'll escalate it on the enterprise support side if they are non-responsive. Are you wanting to do this at the boot loader or do you think it should happen in userland? Does anyone know if the code revogirl was working on for semi-persistant values is in a usable state and worth using for this? I likely misunderstood where you were going with the certificate query, the "beta" iMessage conversation does things out of order, but are you wondering if there is a CSR value that is being stored to NVRAM or something? I fooled around with Revogirl's nvramstorage code over the weekend. It needed some tweaks to some hardcoded variables but it does work in loading variables during boot. It does not save variables before shutdown/reboot (which i think was intended) but probably not too hard to modify to do that. She does use sandbox and i'm not sure why she was doing that. I was going to try loading ROM and MBL at boot but didn't have time this weekend, although i don't think that is necessarily the problem. Also, her launcher daemon is pretty far in the boot process so we may need to have these variables loaded by the bootloader (if they are a piece of the puzzle, which i'm not sure they are). It would be good to find the code needed to modify chameleon to include these variables at boot. I don't have any experience with chameleon so if someone else does and knows what needs to be updated to inject nvram variables, feel free to chime in. Link to comment Share on other sites More sharing options...
cosmo1t Posted January 7, 2013 Share Posted January 7, 2013 Yes since i'm getting a null reference in the subject line, i'm wodnering if they are submitting a csr that is using something from the machine in the subject.. was just curious. I created a true recovery pratition , enabled fmm, and then i saw that message and not just the empty account... so it made me wonder.. But for persistant values, on shutdown, it'd obviously have to be userland kext.. but i was suggesting bootloader only if values are needed before userland is up and running Can you send me the source please to her stuff. You can do it on forge.voodooprojects.org if that'd make u feel better.. you can pm me as well. I can work w/ meklort and can figure out the best approach. thanks cos Link to comment Share on other sites More sharing options...
rcork Posted January 7, 2013 Share Posted January 7, 2013 Yes since i'm getting a null reference in the subject line, i'm wodnering if they are submitting a csr that is using something from the machine in the subject.. was just curious. I created a true recovery pratition , enabled fmm, and then i saw that message and not just the empty account... so it made me wonder.. But for persistant values, on shutdown, it'd obviously have to be userland kext.. but i was suggesting bootloader only if values are needed before userland is up and running Can you send me the source please to her stuff. You can do it on forge.voodooprojects.org if that'd make u feel better.. you can pm me as well. I can work w/ meklort and can figure out the best approach. thanks cos Here's a link to her nvramstorage Github: https://github.com/RevoGirl/nvramStorage In her nvramSetup script, make sure to change the variable targetVolume As for what variables to inject from the booter, i think we should start with ROM and MLB but we need some way of being able to do that dynamically via a preference file so that we don't have to keep changing code while we try different things and debug. 1 Link to comment Share on other sites More sharing options...
cosmo1t Posted January 7, 2013 Share Posted January 7, 2013 anyone w/ a working ML with messages, what does nvram -xp give u? Link to comment Share on other sites More sharing options...
rcork Posted January 7, 2013 Share Posted January 7, 2013 anyone w/ a working ML with messages, what does nvram -xp give u? Do you mean from a real mac? Link to comment Share on other sites More sharing options...
fffeee Posted January 7, 2013 Share Posted January 7, 2013 On my Mini it returns these 13 keys (and their values): <key>EFIBluetoothDelay</key> <key>LocationServicesEnabled</key> <key>RemoteDisabled</key> <key>SystemAudioVolume</key> <key>bluetoothActiveControllerInfo</key> <key>boot-args</key> <key>boot-gamma</key> <key>efi-apple-recovery</key> <key>efi-boot-device</key> <key>efi-boot-device-data</key> <key>fmm-computer-name</key> <key>good-samaritan-message</key> <key>prev-lang:kbd</key> Values are the same after I sign in to iMessage as well. Link to comment Share on other sites More sharing options...
DavidMIRV Posted January 7, 2013 Share Posted January 7, 2013 anyone w/ a working ML with messages, what does nvram -xp give u? from a real mac - removed data vals .. They're all some kind of encrypted string <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>BootCampHD</key> <data> -removed> </data> <key>LocationServicesEnabled</key> <data> AQ== </data> <key>SystemAudioVolume</key> <data> HQ== </data> <key>backlight-level</key> <data> AwM= </data> <key>boot-gamma</key> <data> -removed> </data> <key>boot-image</key> <data> -removed> </data> <key>efi-boot-device</key> <data> -removed> </data> <key>efi-boot-device-data</key> <data> -removed> </data> <key>fmm-computer-name</key> <data> -removed> </data> <key>fmm-mobileme-token-FMM</key> <data> -removed> </data> <key>gpu-policy</key> <data> AQ== </data> <key>prev-lang:kbd</key> <data> ZW46MA== </data> </dict> </plist> Link to comment Share on other sites More sharing options...
fffeee Posted January 7, 2013 Share Posted January 7, 2013 They're not encrypted, they're just encoded, if you don't pass the 'x' and just use 'nvram -p' you'll get them in ASCII. Link to comment Share on other sites More sharing options...
rcork Posted January 7, 2013 Share Posted January 7, 2013 There are variables that aren't printed when you run nvram -xp. For example, 4D1EDE05-38C7-4A6A-9CC6-4BCCA8B38C14:MLB and 4D1EDE05-38C7-4A6A-9CC6-4BCCA8B38C14:ROM. There are more than just those two. If you boot with Refit and load Dumpueficalls.efi you will get a log file that shows all the variables and that are in nvram. Link to comment Share on other sites More sharing options...
cosmo1t Posted January 8, 2013 Share Posted January 8, 2013 good-samaritan-message That sounds interesting. rcork can u do that w/ refit please? Link to comment Share on other sites More sharing options...
ZackehSoul Posted January 8, 2013 Share Posted January 8, 2013 How could they fix it, but only for VMware? They'll need to expose the method used to get values from NVRAM. VMware would fix the bug via a software update to their product rather than instruct on how to fix it inside the system, meaning you'd only get it working through VMs (as would be the only thing they care about). Meaning you'd have a lot of work on your hands regardless of their fix, if only to figure out how they fixed it in the first place. Right? Link to comment Share on other sites More sharing options...
Recommended Posts