Iona Hrapsa ihrapsa

Reverse Engineered VAS Protocol Specification

Research by Grayson Martin
Last Updated 7/8/23

Introduction

Value Added Services (VAS) is the protocol used by NFC capable passes in Apple Wallet. Access to this protocol is heavily restricted on both the device end (a special certificate issued by Apple is required to create these passes) and the reader end (NDA enforced confidentiality). As such, a desire arose to better understand the protocol in order to explore additional use cases and examine its cryptographic integrity. There are gaps in understanding in certain parts of this protocol, however this document contains the minimum necessary understanding to automatically select, read data from, and decrypt a pass.

Importantly, this specification does not enable a malicious actor to read the data from a pass for which they do not have both the reader's private key, and the pass type identifier. Imp

macOS Internals

Understand your Mac and iPhone more deeply by tracing the evolution of Mac OS X from prelease to Swift. John Siracusa delivers the details.

Starting Points

How to use this gist

You've got two main options:

READ THIS FIRST

Adaptive bed mesh is merged into klipper master branch. You can use this feature without this custom macro. Official klipper adaptive bed mesh

Klipper mesh on print area only install guide

What this macro do

This macro will dynamically changing the bed mesh area based on the size of the parts will be printed. The fw will only probe on the area that the part will be printed (plus mesh_area_offset value)

About

I faced bandwidth issues between a WG Peer and a WG server. Download bandwidth when downloading from WG Server to WG peer was reduced significantly and upload bandwidth was practically non existent.
I found a few reddit posts that said that we need to choose the right MTU. So I wrote a script to find an optimal MTU.
Ideally I would have liked to have run all possible MTU configurations for both WG Server and WG Peer but for simplicity I choose to fix the WG Server to the original 1420 MTU and tried all MTUs from 1280 to 1500 for the WG Peer.

Testing

On WG server, I started an iperf3 server
On WG peer, I wrote a script that does the following:
- wg-quick down wg0
Edit MTU in the /etc/wireguard/wg0.conf file

	Unfortunately I have some bad news for downgrading.
	Before I explain the bad news at the end of this post, I first need to introduce a background of iOS devices.
	In iOS 16, Apple introduced a new firmware component known as Cryptex1. Technically, this is a "virtual" co-processor.
	It's purpose is to allow Apple to push RSRs (Rapid Security Responses) which are separate from traditional iOS updates and can be installed much faster.
	Like other firmwares, it also has a signing ticket locked to a cryptographic nonce (number-used-once).
	We commonly refer to the Apple signing tickets as SHSH blobs.
	Meaning the firmware can't be installed without a valid signing ticket as well as a matching nonce.
	The "big two" components we deal with signing/nonces are AP and SEP. AP is basically the main device chip (Application Processor).
	SEP is the security chip (Secure Enclave Processor).
	With regards to APNonce, Apple conveniently gave us the com.apple.System.boot-nonce NVRAM property which we use to set the APNonce generator.

	1. Download STLinkReflash (Version 190812 tested)
	2. Modify the following offsets in STLinkReflash.exe
	2566 3C > 38
	2567 40 > C0
	26B2 3C > 38
	26B3 4A > C0
	3. Run STLinkReflash.exe and accept, selecting option 1.
	4. Fun and profit!

	// After the example from https://github.com/KhaosT/HAP-NodeJS/commit/80cdb1535f5bee874cc06657ef283ee91f258815

	import { Service } from 'homebridge';

	import Platform, { DevicePlatformAccessory } from '../../platform';
	import Accessory from '../../types/Accessory';

	export default class NFCDoorAccessory implements Accessory {
	private get Characteristic() {
	return this.platform.Characteristic;

	# based on: https://community.home-assistant.io/t/tuya-radiator-valve-ts0601-calibration-from-external-sensor-via-zigbee2mqtt/337991
	# alternative: https://community.home-assistant.io/t/sync-trv-with-external-tempature-sensor/298024

	blueprint:
	name: Temperature Calibration
	description: Temperature calibration for Zigbee valve TS0601, according to external temperature sensor
	domain: automation
	input:
	valve:
	name: Smart Valve

	blueprint:
	name: Sync TRV temperature
	description: Sync external temperature sensor with TRV temperature
	domain: automation
	input:
	ieeeaddressoftrv:
	name: IEEE Address
	description: This is the address of the TRV found in your zigbee database example 0x459877fffe1f2e83
	external_temp:
	name: Select the external temp sensor

	codesign --sign - --force --deep /Applications/VSCodium.app
	xattr -d com.apple.quarantine /Applications/VSCodium.app