Activation Token

iTunes gets a couple things from the phone: the DeviceID, the CHIPID, the IMEI, the ICCID, the IMSI, the phone number (!), and a few other things. This is called the "activation token" and is unique to every iPhone. This token is then sent to the Apple server (alfred.apple.com) via SSL. If the phone number can be matched to the ICCID and IMSI and if the rest of the data is correct, the server appends the WildcardTicket to the token, signs the token with Apple's private key and transmits it back to iTunes. iTunes then calls AMDeviceActivate with this signed token. The device gets the token and checks whether or not the signature matches the token. If it does and if the baseband is able to log in to a GSM network, the device is activated. A patched lockdownd circumvents these checks rather then to provide a valid token.

Layout Activation Token

 <?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
       <key>ActivationInfoComplete</key>
       <true/>
       <key>ActivationInfoXML</key>
       
       (base64-encoded activation info here)
       
       <key>FairPlayCertChain</key>
       
       (base64-encoded DRM cert here)
       
       <key>FairPlaySignature</key>
       
       (base64-encoded signature probably of ActivationInfoXML)
       
 </dict>

Layout ActivationInfo

 <?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
       <key>ActivationRandomness</key>
       <string>...</string>
       <key>ActivationRequiresActivationTicket</key>
       <true/>
       <key>ActivationState</key>
       <string>Unactivated</string>
       <key>BasebandMasterKeyHash</key>
       <string>(TEA key)</string>
       <key>BasebandThumbprint</key>
       <string>(TEA key)string>
       <key>BuildVersion</key>
       <string>8A306</string>
       <key>DeviceCertRequest</key>
       
       (base64 encoded cert)
       
       <key>DeviceClass</key>
       <string>iPhone</string>
       <key>IntegratedCircuitCardIdentity</key>
       <string>...</string>
       <key>InternationalMobileEquipmentIdentity</key>
       <string>...</string>
       <key>InternationalMobileSubscriberIdentity</key>
       <string>...</string>
       <key>ModelNumber</key>
       <string>MC135</string>
       <key>PhoneNumber</key>
       <string>...</string>
       <key>ProductType</key>
       <string>iPhone2,1</string>
       <key>ProductVersion</key>
       <string>4.0.1</string>
       <string>SIMGID1</string>
       
       ...
       
       <string>SIMGID2</string>
       
       ...
       
       <key>SIMStatus</key>
       <string>kCTSIMSupportSIMStatusReady</string>
       <key>SerialNumber</key>
       <string>...</string>
       <key>SupportsPostponement</key>
       <true/>
       <key>UniqueChipID</key>
       <integer>...</integer>
       <key>UniqueDeviceID</key>
       <string>...</string>
 </dict>
 </plist>

Resources

• posixninja's iDeviceActivate