MobileDevice Framework AMDeviceCopyValue获取ECID
（希望这篇文章不要太乱）你好，我有一个关于移动设备库中的AMDeviceCopyValue函数的问题，因为我想从一个连接的iDevice获取ECID并在c控制台中打印它。
#include "MobileDevice.h" void device_callback(struct am_device_notification_callback_info *info, void *arg) { struct am_device *dev; if (info->msg == ADNCI_MSG_CONNECTED) { dev = info->dev; CFRetain(dev); AMDSetLogLevel(5); AMDeviceConnect(dev); assert(AMDeviceIsPaired(dev)); assert(!AMDeviceValidatePairing(dev)); assert(!AMDeviceStartSession(dev)); assert(AMDeviceIsPaired(dev)); assert(AMDeviceValidatePairing(dev) == 0); CFStringRef Serial = AMDeviceCopyValue(dev, 0, CFSTR("SerialNumber")); printf("Serial (%s)", CFStringGetCStringPtr(Serial, CFStringGetSystemEncoding())); } } int main(int argc, char *argv[]) { struct am_device_notification *notify; AMDeviceNotificationSubscribe(&device_callback, 0, 0, NULL, ¬ify); CFRunLoopRun(); } 这个代码会打印出iDevice的序列号，但是我希望它打印出ECID，所以我在theiphonewiki阅读，如果我想要得到ECID，我不得不使用值“UniqueChipID”与函数（AMDeviceCopyValue） 链接
但是这似乎并没有很好的工作….
因为如果我编辑从SerialNumber值UniqueChipID，并运行代码它都崩溃…. 🙁
所以如果你想试图帮助我，首先你必须创build一个头文件（我称之为MobileDevice.h）（你也必须添加MobileDevice.framework（它是一个在/ System / Library / PrivateFrameworks中find的私人的苹果框架）并将此代码添加到MobileDevice.h
/* ---------------------------------------------------------------------------- * MobileDevice.h - interface to MobileDevice.framework * $LastChangedDate: 2007-07-09 18:59:29 -0700 (Mon, 09 Jul 2007) $ * * Copied from http://iphonesvn.halifrag.com/svn/iPhone/ * With modifications from Allen Porter and Scott Turner * * ------------------------------------------------------------------------- */ #ifndef MOBILEDEVICE_H #define MOBILEDEVICE_H #ifdef __cplusplus extern "C" { #endif #if defined(WIN32) #include <CoreFoundation.h> typedef unsigned int mach_error_t; #elif defined(__APPLE__) #include <CoreFoundation/CoreFoundation.h> #include <mach/error.h> #endif /* Error codes */ #define MDERR_APPLE_MOBILE (err_system(0x3a)) #define MDERR_IPHONE (err_sub(0)) /* Apple Mobile (AM*) errors */ #define MDERR_OK ERR_SUCCESS #define MDERR_SYSCALL (ERR_MOBILE_DEVICE | 0x01) #define MDERR_OUT_OF_MEMORY (ERR_MOBILE_DEVICE | 0x03) #define MDERR_QUERY_FAILED (ERR_MOBILE_DEVICE | 0x04) #define MDERR_INVALID_ARGUMENT (ERR_MOBILE_DEVICE | 0x0b) #define MDERR_DICT_NOT_LOADED (ERR_MOBILE_DEVICE | 0x25) /* Apple File Connection (AFC*) errors */ #define MDERR_AFC_OUT_OF_MEMORY 0x03 /* USBMux errors */ #define MDERR_USBMUX_ARG_NULL 0x16 #define MDERR_USBMUX_FAILED 0xffffffff /* Messages passed to device notification callbacks: passed as part of * am_device_notification_callback_info. */ #define ADNCI_MSG_CONNECTED 1 #define ADNCI_MSG_DISCONNECTED 2 #define ADNCI_MSG_UNKNOWN 3 #define AMD_IPHONE_PRODUCT_ID 0x1290 #define AMD_IPHONE_SERIAL "3391002d9c804d105e2c8c7d94fc35b6f3d214a3" /* Services, found in /System/Library/Lockdown/Services.plist */ #define AMSVC_AFC CFSTR("com.apple.afc") #define AMSVC_BACKUP CFSTR("com.apple.mobilebackup") #define AMSVC_CRASH_REPORT_COPY CFSTR("com.apple.crashreportcopy") #define AMSVC_DEBUG_IMAGE_MOUNT CFSTR("com.apple.mobile.debug_image_mount") #define AMSVC_NOTIFICATION_PROXY CFSTR("com.apple.mobile.notification_proxy") #define AMSVC_PURPLE_TEST CFSTR("com.apple.purpletestr") #define AMSVC_SOFTWARE_UPDATE CFSTR("com.apple.mobile.software_update") #define AMSVC_SYNC CFSTR("com.apple.mobilesync") #define AMSVC_SCREENSHOT CFSTR("com.apple.screenshotr") #define AMSVC_SYSLOG_RELAY CFSTR("com.apple.syslog_relay") #define AMSVC_SYSTEM_PROFILER CFSTR("com.apple.mobile.system_profiler") typedef unsigned int afc_error_t; typedef unsigned int usbmux_error_t; typedef unsigned int service_conn_t; struct am_recovery_device; typedef struct am_device_notification_callback_info { struct am_device *dev; /* 0 device */ unsigned int msg; /* 4 one of ADNCI_MSG_* */ } __attribute__ ((packed)) am_device_notification_callback_info; /* The type of the device restore notification callback functions. * TODO: change to correct type. */ typedef void (*am_restore_device_notification_callback)(struct am_recovery_device *); /* This is a CoreFoundation object of class AMRecoveryModeDevice. */ typedef struct am_recovery_device { unsigned char unknown0[8]; /* 0 */ am_restore_device_notification_callback callback; /* 8 */ void *user_info; /* 12 */ unsigned char unknown1[12]; /* 16 */ unsigned int readwrite_pipe; /* 28 */ unsigned char read_pipe; /* 32 */ unsigned char write_ctrl_pipe; /* 33 */ unsigned char read_unknown_pipe; /* 34 */ unsigned char write_file_pipe; /* 35 */ unsigned char write_input_pipe; /* 36 */ } __attribute__ ((packed)) am_recovery_device; /* A CoreFoundation object of class AMRestoreModeDevice. */ typedef struct am_restore_device { unsigned char unknown[32]; int port; } __attribute__ ((packed)) am_restore_device; /* The type of the device notification callback function. */ typedef void(*am_device_notification_callback)(struct am_device_notification_callback_info *, void* arg); /* The type of the _AMDDeviceAttached function. * TODO: change to correct type. */ typedef void *amd_device_attached_callback; typedef struct am_device { unsigned char unknown0[16]; /* 0 - zero */ unsigned int device_id; /* 16 */ unsigned int product_id; /* 20 - set to AMD_IPHONE_PRODUCT_ID */ char *serial; /* 24 - set to AMD_IPHONE_SERIAL */ unsigned int unknown1; /* 28 */ unsigned char unknown2[4]; /* 32 */ unsigned int lockdown_conn; /* 36 */ unsigned char unknown3[8]; /* 40 */ } __attribute__ ((packed)) am_device; typedef struct am_device_notification { unsigned int unknown0; /* 0 */ unsigned int unknown1; /* 4 */ unsigned int unknown2; /* 8 */ am_device_notification_callback callback; /* 12 */ unsigned int unknown3; /* 16 */ } __attribute__ ((packed)) am_device_notification; typedef struct afc_connection { unsigned int handle; /* 0 */ unsigned int unknown0; /* 4 */ unsigned char unknown1; /* 8 */ unsigned char padding[3]; /* 9 */ unsigned int unknown2; /* 12 */ unsigned int unknown3; /* 16 */ unsigned int unknown4; /* 20 */ unsigned int fs_block_size; /* 24 */ unsigned int sock_block_size; /* 28: always 0x3c */ unsigned int io_timeout; /* 32: from AFCConnectionOpen, usu. 0 */ void *afc_lock; /* 36 */ unsigned int context; /* 40 */ } __attribute__ ((packed)) afc_connection; typedef struct afc_directory { unsigned char unknown[0]; /* size unknown */ } __attribute__ ((packed)) afc_directory; typedef struct afc_dictionary { unsigned char unknown[0]; /* size unknown */ } __attribute__ ((packed)) afc_dictionary; typedef unsigned long long afc_file_ref; typedef struct usbmux_listener_1 { /* offset value in iTunes */ unsigned int unknown0; /* 0 1 */ unsigned char *unknown1; /* 4 ptr, maybe device? */ amd_device_attached_callback callback; /* 8 _AMDDeviceAttached */ unsigned int unknown3; /* 12 */ unsigned int unknown4; /* 16 */ unsigned int unknown5; /* 20 */ } __attribute__ ((packed)) usbmux_listener_1; typedef struct usbmux_listener_2 { unsigned char unknown0[4144]; } __attribute__ ((packed)) usbmux_listener_2; typedef struct am_bootloader_control_packet { unsigned char opcode; /* 0 */ unsigned char length; /* 1 */ unsigned char magic[2]; /* 2: 0x34, 0x12 */ unsigned char payload[0]; /* 4 */ } __attribute__ ((packed)) am_bootloader_control_packet; /* ---------------------------------------------------------------------------- * Public routines * ------------------------------------------------------------------------- */ void AMDSetLogLevel(int level); /* Registers a notification with the current run loop. The callback gets * copied into the notification struct, as well as being registered with the * current run loop. dn_unknown3 gets copied into unknown3 in the same. * (Maybe dn_unknown3 is a user info parameter that gets passed as an arg to * the callback?) unused0 and unused1 are both 0 when iTunes calls this. * In iTunes the callback is located from $3db78e-$3dbbaf. * * Returns: * MDERR_OK if successful * MDERR_SYSCALL if CFRunLoopAddSource() failed * MDERR_OUT_OF_MEMORY if we ran out of memory */ mach_error_t AMDeviceNotificationSubscribe(am_device_notification_callback callback, unsigned int unused0, unsigned int unused1, void* //unsigned int dn_unknown3, struct am_device_notification **notification); /* Connects to the iPhone. Pass in the am_device structure that the * notification callback will give to you. * * Returns: * MDERR_OK if successfully connected * MDERR_SYSCALL if setsockopt() failed * MDERR_QUERY_FAILED if the daemon query failed * MDERR_INVALID_ARGUMENT if USBMuxConnectByPort returned 0xffffffff */ mach_error_t AMDeviceConnect(struct am_device *device); /* Calls PairingRecordPath() on the given device, than tests whether the path * which that function returns exists. During the initial connect, the path * returned by that function is '/', and so this returns 1. * * Returns: * 0 if the path did not exist * 1 if it did */ int AMDeviceIsPaired(struct am_device *device); /* iTunes calls this function immediately after testing whether the device is * paired. It creates a pairing file and establishes a Lockdown connection. * * Returns: * MDERR_OK if successful * MDERR_INVALID_ARGUMENT if the supplied device is null * MDERR_DICT_NOT_LOADED if the load_dict() call failed */ mach_error_t AMDeviceValidatePairing(struct am_device *device); /* Creates a Lockdown session and adjusts the device structure appropriately * to indicate that the session has been started. iTunes calls this function * after validating pairing. * * Returns: * MDERR_OK if successful * MDERR_INVALID_ARGUMENT if the Lockdown conn has not been established * MDERR_DICT_NOT_LOADED if the load_dict() call failed */ mach_error_t AMDeviceStartSession(struct am_device *device); /* Starts a service and returns a handle that can be used in order to further * access the service. You should stop the session and disconnect before using * the service. iTunes calls this function after starting a session. It starts * the service and the SSL connection. unknown may safely be * NULL (it is when iTunes calls this), but if it is not, then it will be * filled upon function exit. service_name should be one of the AMSVC_* * constants. If the service is AFC (AMSVC_AFC), then the handle is the handle * that will be used for further AFC* calls. * * Returns: * MDERR_OK if successful * MDERR_SYSCALL if the setsockopt() call failed * MDERR_INVALID_ARGUMENT if the Lockdown conn has not been established */ mach_error_t AMDeviceStartService(struct am_device *device, CFStringRef service_name, service_conn_t *handle, unsigned int * unknown); mach_error_t AMDeviceStartHouseArrestService(struct am_device *device, CFStringRef identifier, void *unknown, service_conn_t *handle, unsigned int *what); /* Stops a session. You should do this before accessing services. * * Returns: * MDERR_OK if successful * MDERR_INVALID_ARGUMENT if the Lockdown conn has not been established */ mach_error_t AMDeviceStopSession(struct am_device *device); /* Opens an Apple File Connection. You must start the appropriate service * first with AMDeviceStartService(). In iTunes, io_timeout is 0. * * Returns: * MDERR_OK if successful * MDERR_AFC_OUT_OF_MEMORY if malloc() failed */ afc_error_t AFCConnectionOpen(service_conn_t handle, unsigned int io_timeout, struct afc_connection **conn); /* Pass in a pointer to an afc_device_info structure. It will be filled. */ afc_error_t AFCDeviceInfoOpen(afc_connection *conn, struct afc_dictionary **info); /* Turns debug mode on if the environment variable AFCDEBUG is set to a numeric * value, or if the file '/AFCDEBUG' is present and contains a value. */ void AFCPlatformInit(); /* Opens a directory on the iPhone. Pass in a pointer in dir to be filled in. * Note that this normally only accesses the iTunes sandbox/partition as the * root, which is /var/root/Media. Pathnames are specified with '/' delimiters * as in Unix style. * * Returns: * MDERR_OK if successful */ afc_error_t AFCDirectoryOpen(afc_connection *conn, const char *path, struct afc_directory **dir); /* Acquires the next entry in a directory previously opened with * AFCDirectoryOpen(). When dirent is filled with a NULL value, then the end * of the directory has been reached. '.' and '..' will be returned as the * first two entries in each directory except the root; you may want to skip * over them. * * Returns: * MDERR_OK if successful, even if no entries remain */ afc_error_t AFCDirectoryRead(afc_connection *conn/*unsigned int unused*/, struct afc_directory *dir, char **dirent); afc_error_t AFCDirectoryClose(afc_connection *conn, struct afc_directory *dir); afc_error_t AFCDirectoryCreate(afc_connection *conn, const char *dirname); afc_error_t AFCRemovePath(afc_connection *conn, const char *dirname); afc_error_t AFCRenamePath(afc_connection *conn, const char *from, const char *to); afc_error_t AFCLinkPath(afc_connection *conn, long long int linktype, const char *target, const char *linkname); /* Returns the context field of the given AFC connection. */ unsigned int AFCConnectionGetContext(afc_connection *conn); /* Returns the fs_block_size field of the given AFC connection. */ unsigned int AFCConnectionGetFSBlockSize(afc_connection *conn); /* Returns the io_timeout field of the given AFC connection. In iTunes this is * 0. */ unsigned int AFCConnectionGetIOTimeout(afc_connection *conn); /* Returns the sock_block_size field of the given AFC connection. */ unsigned int AFCConnectionGetSocketBlockSize(afc_connection *conn); /* Closes the given AFC connection. */ afc_error_t AFCConnectionClose(afc_connection *conn); /* Registers for device notifications related to the restore process. unknown0 * is zero when iTunes calls this. In iTunes, * the callbacks are located at: * 1: $3ac68e-$3ac6b1, calls $3ac542(unknown1, arg, 0) * 2: $3ac66a-$3ac68d, calls $3ac542(unknown1, 0, arg) * 3: $3ac762-$3ac785, calls $3ac6b2(unknown1, arg, 0) * 4: $3ac73e-$3ac761, calls $3ac6b2(unknown1, 0, arg) */ unsigned int AMRestoreRegisterForDeviceNotifications( am_restore_device_notification_callback dfu_connect_callback, am_restore_device_notification_callback recovery_connect_callback, am_restore_device_notification_callback dfu_disconnect_callback, am_restore_device_notification_callback recovery_disconnect_callback, unsigned int unknown0, void *user_info); /* Causes the restore functions to spit out (unhelpful) progress messages to * the file specified by the given path. iTunes always calls this right before * restoring with a path of * "$HOME/Library/Logs/iPhone Updater Logs/iPhoneUpdater X.log", where X is an * unused number. */ unsigned int AMRestoreEnableFileLogging(char *path); /* Initializes a new option dictionary to default values. Pass the constant * kCFAllocatorDefault as the allocator. The option dictionary looks as * follows: * { * NORImageType => 'production', * AutoBootDelay => 0, * KernelCacheType => 'Release', * UpdateBaseband => true, * DFUFileType => 'RELEASE', * SystemImageType => 'User', * CreateFilesystemPartitions => true, * FlashNOR => true, * RestoreBootArgs => 'rd=md0 nand-enable-reformat=1 -progress' * BootImageType => 'User' * } * * Returns: * the option dictionary if successful * NULL if out of memory */ CFMutableDictionaryRef AMRestoreCreateDefaultOptions(CFAllocatorRef allocator); /* ---------------------------------------------------------------------------- * Less-documented public routines * ------------------------------------------------------------------------- */ /* mode 2 = read, mode 3 = write */ afc_error_t AFCFileRefOpen(afc_connection *conn, const char *path, unsigned long long mode, afc_file_ref *ref); afc_error_t AFCFileRefSeek(afc_connection *conn, afc_file_ref ref, unsigned long long offset1, unsigned long long offset2); afc_error_t AFCFileRefRead(afc_connection *conn, afc_file_ref ref, void *buf, unsigned int *len); afc_error_t AFCFileRefSetFileSize(afc_connection *conn, afc_file_ref ref, unsigned long long offset); afc_error_t AFCFileRefWrite(afc_connection *conn, afc_file_ref ref, const void *buf, unsigned int len); afc_error_t AFCFileRefClose(afc_connection *conn, afc_file_ref ref); afc_error_t AFCFileInfoOpen(afc_connection *conn, const char *path, struct afc_dictionary **info); afc_error_t AFCKeyValueRead(struct afc_dictionary *dict, char **key, char ** val); afc_error_t AFCKeyValueClose(struct afc_dictionary *dict); unsigned int AMRestorePerformRecoveryModeRestore(struct am_recovery_device * rdev, CFDictionaryRef opts, void *callback, void *user_info); unsigned int AMRestorePerformRestoreModeRestore(struct am_restore_device * rdev, CFDictionaryRef opts, void *callback, void *user_info); struct am_restore_device *AMRestoreModeDeviceCreate(unsigned int unknown0, unsigned int connection_id, unsigned int unknown1); unsigned int AMRestoreCreatePathsForBundle(CFStringRef restore_bundle_path, CFStringRef kernel_cache_type, CFStringRef boot_image_type, unsigned int unknown0, CFStringRef *firmware_dir_path, CFStringRef * kernelcache_restore_path, unsigned int unknown1, CFStringRef * ramdisk_path); unsigned int AMDeviceGetConnectionID(struct am_device *device); mach_error_t AMDeviceEnterRecovery(struct am_device *device); mach_error_t AMDeviceDisconnect(struct am_device *device); mach_error_t AMDeviceRetain(struct am_device *device); mach_error_t AMDeviceRelease(struct am_device *device); CFStringRef AMDeviceCopyValue(struct am_device *device, unsigned int, CFStringRef cfstring); CFStringRef AMDeviceCopyDeviceIdentifier(struct am_device *device); typedef void (*notify_callback)(CFStringRef notification, void *data); mach_error_t AMDPostNotification(service_conn_t socket, CFStringRef notification, CFStringRef userinfo); mach_error_t AMDObserveNotification(void *socket, CFStringRef notification); mach_error_t AMDListenForNotifications(void *socket, notify_callback cb, void *data); mach_error_t AMDShutdownNotificationProxy(void *socket); /*edits by geohot*/ mach_error_t AMDeviceDeactivate(struct am_device *device); mach_error_t AMDeviceActivate(struct am_device *device, CFMutableDictionaryRef); /*end*/ void *AMDeviceSerialize(struct am_device *device); void AMDAddLogFileDescriptor(int fd); //kern_return_t AMDeviceSendMessage(service_conn_t socket, void *unused, CFPropertyListRef plist); //kern_return_t AMDeviceReceiveMessage(service_conn_t socket, CFDictionaryRef options, CFPropertyListRef * result); /* ---------------------------------------------------------------------------- * Semi-private routines * ------------------------------------------------------------------------- */ /* Pass in a usbmux_listener_1 structure and a usbmux_listener_2 structure * pointer, which will be filled with the resulting usbmux_listener_2. * * Returns: * MDERR_OK if completed successfully * MDERR_USBMUX_ARG_NULL if one of the arguments was NULL * MDERR_USBMUX_FAILED if the listener was not created successfully */ usbmux_error_t USBMuxListenerCreate(struct usbmux_listener_1 *esi_fp8, struct usbmux_listener_2 **eax_fp12); /* ---------------------------------------------------------------------------- * Less-documented semi-private routines * ------------------------------------------------------------------------- */ usbmux_error_t USBMuxListenerHandleData(void *); /* ---------------------------------------------------------------------------- * Private routines - here be dragons * ------------------------------------------------------------------------- */ /* AMRestorePerformRestoreModeRestore() calls this function with a dictionary * in order to perform certain special restore operations * (RESTORED_OPERATION_*). It is thought that this function might enable * significant access to the phone. */ typedef unsigned int (*t_performOperation)(struct am_restore_device *rdev, CFDictionaryRef op); // __attribute__ ((regparm(2))); #ifdef __cplusplus } #endif #endif
会爱我所能得到的任何帮助！ 我希望这个post是不是很乱？
与UniqueChipID关联的值是CFNumber而不是CFString。
4 : <CFString 0x7fa18bf62f90 [0x7fff7279ecf0]>{contents = "UniqueChipID"} = <CFNumber 0x18a19201535c55c5 [0x7fff7279ecf0]>{value = +0000000000000000, type = kCFNumberSInt64Type}
顺便说一句，CFShow是你的朋友。 例：
CFNumberRef ecid = AMDeviceCopyValue(dev, 0, CFSTR("UniqueChipID"));