Repository navigation
Conversation
Apple now rejects GrandSlam 2FA and developer services requests that identify as Windows/iTunes. Use the client info returned by the anisette server instead of overriding it, and default to a Mac anisette server. The anisette state file is renamed so states provisioned under the old identity are not reused. fixes claration#298 fixes claration#300
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #298, fixes #300.
Heads up: this changes
DEFAULT_ANISETTE_URL_V3(a hardcoded link), as suggested in #298. Happy to change it to another Mac server if you prefer.Summary
Apple now rejects GrandSlam 2FA (
-80046) and developer services (1100 Your session has expiredonlistTeams) when the client info says Windows/iTunes. Other sideloaders switched to Mac anisette for the same reason (xtool-org/xtool#380, nab138/iloader@9025973).RemoteAnisetteProviderV3fetched/v3/client_infofrom the server and then replaced it with the hardcoded WindowsCLIENT_INFO_HEADER(added in 321eac4 for-80045). Now it uses what the server returns:AnisetteClient::new GET {url}/v3/client_info - client_info = CLIENT_INFO_HEADER // <PC> <Windows;6.2(0,0);9200> <… com.apple.iTunes/12.12.4.1> + client_info = server response // <MacBookPro13,3> <Mac OS X;10.12.6;16G29> <… com.apple.akd/1.0>DEFAULT_ANISETTE_URL_V3:https://ani.sidestore.app→https://mac-ani.jkcoxson.comstate.plist→mac_anisette_state.plist, so states provisioned under the old identity are not reused. "Reset Anisette Data" deletes the new file.The local SSC/adi_proxy path is unchanged.
Evidence
macOS (arm64), free account, trusted device 2FA:
-80046after entering the 2FA code. With an existing saved session,plumesign account certificatesfails withDeveloper API error 1100 ... listTeams.action.plumesign account certificates. Signed and installed an IPA to an iPhone from the GUI.Merge Danger
Door: two-way. It only changes the default server and the identity string. Old state files are left in place and ignored.
Blast Radius: auth. Everyone on the default remote anisette re-provisions once. If Apple starts rejecting Mac identities, login breaks again the same way.