apple-crates

@@ -301,7 +301,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"

 checksum = "2a4385e2e34eb35d6b3efe798b9eb88096925d87726c0798709bf56d9ed84af3"

 [[package]]

-name = "apple-codesign"

+name = "apple-codesign-quick"

 version = "0.1.0"

 dependencies = [

  "byteorder",

@@ -3140,6 +3140,7 @@ dependencies = [

  "srp",

  "sys-locale",

  "thiserror 2.0.18",

+ "tokio",

 ]

 [[package]]

@@ -7088,7 +7089,7 @@ dependencies = [

  "adi",

  "adid-proxy",

  "android-coreadi",

- "apple-codesign",

+ "apple-codesign-quick",

  "async_zip",

  "chrono",

  "core-foundation 0.10.0",

@@ -28,3 +28,6 @@ rand = "0.9.2"

 hex = "0.4.3"

 bytes = "1.10.1"

 log = "0.4.29"

+

+[dev-dependencies]

+tokio.workspace = true

@@ -7,3 +7,41 @@ StoreServicesCore and AppleMediaServices.

 `itunes` is modeled after some personal reversing of iTunes, and 

 the code of [ipatool](https://github.com/majd/ipatool).

+

+## Continuation tokens

+

+Password login requests a continuation token using `ckgen`. When Apple issues

+one, extract it from the decrypted server-provided data:

+

+```rust,ignore

+let outcome = grandslam::login(&session, apple_id, password).await?;

+if let grandslam::AuthOutcome::Success(data) = outcome {

+    if let Some(token) = grandslam::ContinuationToken::from_server_provided_data(&data) {

+        // Save the token securely with this Apple ID and device identity.

+        let resumed = grandslam::login_with_continuation_token(&session, apple_id, &token).await?;

+    }

+}

+```

+

+Continuation login uses the decoded token as the SRP secret and sends

+`cpd.ckauth = true` in both exchanges, omitting `bootstrap` and `ckgen`.

+It returns the same `AuthOutcome` as password login, including secondary actions.

+A successful response preserves the supplied token in `ck` if Apple does not

+return a replacement. Extract and save the token again after success to handle

+rotation. The library does not persist credentials or automatically fall back to

+a password when a token is rejected.

+

+Secondary-action responses can issue a token in `X-Apple-I-CK`. Before consuming

+the response body, call

+`ContinuationToken::from_response_headers(response.headers())` to base64-decode

+that header into a UTF-8 token. An absent header returns `Ok(None)`; malformed

+base64, invalid UTF-8, and empty tokens return an error. The `ck` plist value is

+already decoded and must not be decoded a second time. Tokens support serde for

+secure storage and redact their value in `Debug` output.

+

+These details were traced in AuthKitWin 394.2 in Ghidra:

+`_CopyAuthParametersForAccount` (`0x18003ca60`) selects the SRP secret and flags;

+`_CreateServerResponseFromAuthContext` (`0x18003d570`) reads `ck` and retains the

+input credential when no replacement is issued;

+`AKCreateUpdatedServerResponse` (header lookup at `0x1800391a4`) decodes

+`X-Apple-I-CK` before passing it to `SaveCKToken` (`0x18003c590`).

@@ -195,9 +195,7 @@ pub fn build_client_provided_data(

         "X-Mme-Device-Id": device.device_uuid.clone(),

-        "bootstrap": true,

         "capp": application_information.bundle_name,

-        "ckgen": true,

         "icscrec": true,

         "loc": locale,

         "pbe": false,

@@ -234,10 +232,46 @@ impl TryFrom<u64> for StatusCode {

     }

 }

+#[derive(Clone, PartialEq, Eq)]

+pub struct ContinuationToken(String);

+

 pub async fn login(

     http_session: &AnisetteHTTPSession<'_, '_>,

     apple_id: &str,

     password: &str,

+) -> AuthResult {

+    login_with_credential(http_session, apple_id, LoginCredential::Password(password)).await

+}

+

+/// Authenticate using a previously issued continuation token instead of a password.

+///

+/// Use the Apple ID and device identity associated with the token. The server can

+/// still require a secondary action or reject a revoked token; callers decide

+/// whether to fall back to password authentication. Extract the token from the

+/// returned server-provided data again after success to pick up a replacement.

+pub async fn login_with_continuation_token(

+    http_session: &AnisetteHTTPSession<'_, '_>,

+    apple_id: &str,

+    continuation_token: &ContinuationToken,

+) -> AuthResult {

+    login_with_credential(

+        http_session,

+        apple_id,

+        LoginCredential::ContinuationToken(continuation_token),

+    )

+    .await

+}

+

+#[derive(Clone, Copy)]

+enum LoginCredential<'a> {

+    Password(&'a str),

+    ContinuationToken(&'a ContinuationToken),

+}

+

+async fn login_with_credential(

+    http_session: &AnisetteHTTPSession<'_, '_>,

+    apple_id: &str,

+    credential: LoginCredential<'_>,

 ) -> AuthResult {

     let gs_service_url = http_session

         .url_bag()

@@ -245,7 +279,21 @@ pub async fn login(

         .and_then(Value::as_string)

         .ok_or(AuthError::InvalidURLBag)?;

-    let cpd = build_client_provided_data(http_session)?;

+    let cpd = {

+        let mut cpd = build_client_provided_data(http_session)?;

+

+        match credential {

+            LoginCredential::ContinuationToken(_) => {

+                cpd.insert("ckauth".into(), true.into());

+            }

+            LoginCredential::Password(_) => {

+                cpd.insert("bootstrap".into(), true.into());

+                cpd.insert("ckgen".into(), true.into());

+            }

+        };

+

+        cpd

+    };

     // TODO: implement s4k, if some day someone needs that.

     let srp_client = srp::Client::<G2048, Sha256>::new_with_options(false);

@@ -259,7 +307,7 @@ pub async fn login(

         },

         "Request": dict!{

             "A2k": Value::Data(a_pub),

-            "cpd": cpd,

+            "cpd": cpd.clone(),

             "o": "init",

             "ps": array![

                 "s2k",

@@ -322,11 +370,16 @@ pub async fn login(

         .and_then(|b| b.as_data())

         .ok_or_else(|| AuthError::Structure(response_plist.clone()))?;

+    let secret = match credential {

+        LoginCredential::Password(password) => { password },

+        LoginCredential::ContinuationToken(ck) => { ck.0.as_str() }

+    }.as_bytes();

+

     let hashed_password: Vec<u8> = match selected_protocol {

         // SRP with a 2048/4096-bit long A.

-        "s2k" | "s4k" => Sha256::digest(password.as_bytes()).to_vec(),

+        "s2k" | "s4k" => Sha256::digest(secret).to_vec(),

         // SRP with a 2048-bit long A + fo?

-        "s2k_fo" => hex::encode(Sha256::digest(password.as_bytes())).into_bytes(),

+        "s2k_fo" => hex::encode(Sha256::digest(secret)).into_bytes(),

         _ => {

             return Err(AuthError::UnknownProtocol(selected_protocol.into()));

         }

@@ -342,8 +395,6 @@ pub async fn login(

     let verifier =

         srp_client.process_reply(&a, apple_id.as_bytes(), &processed_password, salt, b)?;

-    let cpd = build_client_provided_data(http_session)?;

-

     let request_plist = dict! {

         "Header": dict!{

             "Version": "1.0.1"

@@ -6,7 +6,7 @@ edition = "2021"

 [dependencies]

 adi.workspace = true

 android-coreadi.workspace = true

-apple-codesign = { path = "../apple-codesign-quick" }

+apple-codesign-quick = { path = "../apple-codesign-quick" }

 async_zip = { version = "0.0.18", features = ["deflate", "tokio", "tokio-fs"] }

 chrono = { version = "0.4.42", default-features = false, features = ["clock"] }

 crc32fast = "1.5"

@@ -8,7 +8,7 @@ use crate::domain::{

     AppEntitlement, AppMetadata, EntitlementValue, EntitlementsSource, IpaApp, NestedBundle,

     NestedBundleKind, Patch, SupportedDeviceFamily,

 };

-use apple_codesign::{

+use apple_codesign_quick::{

     sign_bundle, BundleSigningSettings, ProvisioningProfile, RustCryptoCmsSigner,

 };

 use async_zip::base::read::mem::ZipFileReader as MemoryZipFileReader;