Normal Mode

This is the protocol iTunes uses to talk to the booted iPhone. It uses usbmux to provide TCP like connectivity over a USB port using SSL. There is a pairing process iTunes uses to establish the secure channel.

Device IDs

It appears that it uses different device IDs:

• iPhone - 0x1290
• iPod touch - 0x1291
• iPhone 3G - 0x1292
• iPod touch 2G - 0x1293
• iPhone 2nd Generation - 0x1294 (found on 2.2.1 rootfs - convert product id to hex)

Patch: Disable SSL

There is a way to disable SSL encyption during iTunes communication on jailbroken devices by patching lockdownd binary:

(#) Disable SSL protection

(#) FW 2.1

(#) binary /usr/libexec/lockdownd

-0x1000

Offset 000112F8: 0C 30 98 E5 > 00 30 A0 E3 ; Conn.UseSSL = false

After applying the patch all packets between iPhone and iTunes become plain and clear. Musthave for R&D ppl.

USBMux Protocol

Resources

• MobileDevice Library
• The dev team's page on the topic
• Protocol Documentation
• iFuse