# facetime

Published articles for facetime.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## Reverse Engineering the Apple MultiPeer Connectivity Framework

DevFeed: [Reverse Engineering the Apple MultiPeer Connectivity Framework](<https://devfeed.tech/articles/reverse-engineering-the-apple-multipeer-connectivity-framework-41267.md>)

Original publisher: [Read original article](<https://www.evilsocket.net/2022/10/20/Reverse-Engineering-the-Apple-MultiPeer-Connectivity-Framework/>)

Author: Simone Margaritelli

Published: 2022-10-20T11:05:13Z

Content type: tutorial

Language: en

Sources: [evilsocket](<https://devfeed.tech/sources/evilsocket.md>)

Topics: [Reverse Engineering](<https://devfeed.tech/topics/reverse-engineering.md>), [Protocol (disambiguation)](<https://devfeed.tech/topics/protocol.md>), [Python](<https://devfeed.tech/topics/python.md>), [client](<https://devfeed.tech/topics/client.md>), [Network](<https://devfeed.tech/topics/network.md>), [Framework](<https://devfeed.tech/topics/framework.md>)

Tags: [apple](<https://devfeed.tech/tags/apple.md>), [cybersecurity](<https://devfeed.tech/tags/cybersecurity.md>), [facetime](<https://devfeed.tech/tags/facetime.md>), [framework](<https://devfeed.tech/tags/framework.md>), [ice](<https://devfeed.tech/tags/ice.md>), [ios](<https://devfeed.tech/tags/ios.md>), [iphone](<https://devfeed.tech/tags/iphone.md>), [logic-pro](<https://devfeed.tech/tags/logic-pro.md>), [mac](<https://devfeed.tech/tags/mac.md>), [macos-security](<https://devfeed.tech/tags/macos-security.md>), [mcpeer](<https://devfeed.tech/tags/mcpeer.md>), [mcpeerid](<https://devfeed.tech/tags/mcpeerid.md>), [mdns](<https://devfeed.tech/tags/mdns.md>), [mpc-framework](<https://devfeed.tech/tags/mpc-framework.md>), [multipeer](<https://devfeed.tech/tags/multipeer.md>), [multipeerconnectivity](<https://devfeed.tech/tags/multipeerconnectivity.md>), [network](<https://devfeed.tech/tags/network.md>), [network-packets](<https://devfeed.tech/tags/network-packets.md>), [network-protocol](<https://devfeed.tech/tags/network-protocol.md>), [ospf](<https://devfeed.tech/tags/ospf.md>), [proprietary-protocol](<https://devfeed.tech/tags/proprietary-protocol.md>), [protocol-reversing](<https://devfeed.tech/tags/protocol-reversing.md>), [python](<https://devfeed.tech/tags/python.md>), [re](<https://devfeed.tech/tags/re.md>), [reverse-engineering](<https://devfeed.tech/tags/reverse-engineering.md>), [stun](<https://devfeed.tech/tags/stun.md>), [tcp](<https://devfeed.tech/tags/tcp.md>), [undocumented](<https://devfeed.tech/tags/undocumented.md>), [wireshark](<https://devfeed.tech/tags/wireshark.md>)

### AI overview

A reverse-engineering investigation of Apple's undocumented Multipeer Connectivity Framework. The article examines its custom TCP protocol, documents network packets, and describes a Python proof-of-concept client that discovers servers, establishes connections, and exchanges application data. It also reports parser vulnerabilities and discusses session spoofing.

### Source excerpt

Some time ago I was using Logic Pro to record some of my music and I needed a way to start and stop the recording from an iPhone, so I found about Logic Remote and was quite happy with it. After the session, the hacker in me became curious about how the tools were communicating with each other, so I quickly started Wireshark while establishing a connection and saw something that tickled my curiosity even more: some of the data, such as the client and server names, were transmitted in cleartext on what it seemed a custom (and as typical of Apple, undocumented) TCP protocol ("stevie" being the hostname of my Mac): Using lsof confirmed that this was indeed the communication between the client phone and Logic listening on port 56076: Initially I tought this was just some Logic Pro specific protocol and very lazily started looking into it, without much success mostly due to lack of motivation given the very limited scope of the research. After a while I tweeted asking if anyone had ever seen anything like it. @isComputerOn pointed out that this looked a lot like a protocol that has been partially reversed and presented by Alban Diquet back in 2014. Unfortunately, however brilliant, this research covers the protocol at a very high level and doesn't really document the packets, their fields and how to establish a connection from anything but a client using the Apple framework. However, this helped me a lot in two ways: first it helped me realize this was not just Logic Pro specific, but that it was part of the Multipeer Connectivity Framework, and gave me a few hints about the general logic of the protocol itself. With renewed curiosity and motivation then I jumped into this rabbit hole and managed to reverse engineer all network packets. This allowed me to write a Python proof of concept client that automatically discovers any MPC servers, initializes the connection and succesfully exchanges application specific data packets. Moreover, while sending crafted packets and at