View source for Apple Push Service Protocol

As of iOS5, Apple uses a new push protocol. The same protocol is used on the Mac too. With iOS4, the protocol used message types <code>04</code> to <code>06</code>, while the new protocol uses message types <code>07</code> to <code>0f</code> and all fields have a type-length-value encoding.

==Message Structure==
*1 byte message type
*4 byte payload length
*fields, all with
**1 byte type
**2 byte length
**value

Example:
*<code>07</code> message type (Connect)
*<code>00 00 00 27</code> 39 byte payload length
*<code>01</code> 1st field
**<code>00 20</code> 32 byte length
**<code>8a 73 82 00 82 ac 91 32 88 b6 aa ef 90 91 65 ce 8a 73 82 00 82 ac 91 32 88 b6 aa ef 90 91 65 ce</code>value 1 (32-byte push token)
*<code>02</code> 2nd field
**<code>00 01</code> 1 byte length
**<code>01</code> value

===Messages===

====07 Connect====
*Direction: device to server
*message type: <code>07</code>
*fields:
**<code>01</code> 32-byte push token
**<code>02</code> 1 byte unknown (value <code>01</code>)

====08 Connect Response====
*Direction: server to device
*message type: <code>08</code>
*fields:
**<code>01</code> status (<code>00</code> ok, <code>02</code> some error)
**<code>04</code> unknown (value <code>10 00</code>)
**<code>05</code> unknown (value <code>00 02</code>)
**<code>03</code> 32-byte push token (optional), sent after <code>05</code> field

====09 Push Topics====
*Direction: device to server
*message type: <code>09</code>
*fields:
**<code>02</code> 20-byte ID for enabled topic (like topic for push-enabled app or a specific iCloud service like Find My iPhone)
**<code>03</code> 20-byte ID for disabled topic

====0A Push Notification====
*Direction: server to device (for iMessage and possibly others too, also the other way round)
*message type: <code>0a</code>
*fields:
**<code>01</code> recipient push token
**<code>02</code> topic
**<code>03</code> notification payload
**<code>04</code> response token
**<code>05</code> expiry (32-bit UNIX timestamp)
**<code>06</code> timestamp (64-bit UNIX timestamp in nanoseconds)
**<code>07</code> unknown (<code>00</code>)

====0B Push Notification Response====
*Direction: server to device (for iMessage and possibly others too, also the other way round)
*message type: <code>0b</code>
*fields:
**<code>04</code> response token
**<code>08</code> status (<code>00</code> ok, <code>02</code> error)

====0C Keep-Alive====
*Direction: device to server
*message type: <code>0c</code>
*fields:
**<code>01</code> connection method ("WiFi" or GSM MNC like "31038" for AT&T)
**<code>02</code> iOS version, e.g. "5.0"
**<code>03</code> iOS build number
**<code>04</code> device model, e.g. "iPhone2,1"
**<code>05</code> unknown (values like <code>10</code>, <code>15</code> or <code>20</code>)

====0D Keep-Alive Confirmation====
*Direction: server to device
*message type: <code>0d</code>
*no fields

====0E No Storage====
*Direction: server to device
*message type: <code>0e</code>
*fields:
**<code>03</code> 32-byte push token

====0F Flush====
*Direction: both
*message type: <code>0f</code>
*fields:
**2-byte integer indicating length of padding
**padding: NULL-bytes, typical lengths are 64, 128, 256, 512

==References==
*[https://github.com/meeee/pushproxy/blob/master/doc/apple-push-protocol-ios5-lion.md Source of this info]