Mirror-bot/open-madrid
1
0 Fork 0
mirror of https://github.com/fenleon/open-madrid.git synced 2026-10-22 16:12:35 +00:00
Code Issues Projects Releases Activity
13 Commits 1 Branch 2 Tags
970155a9f00f94f7e2cfc592065cc324e778b852
T
Clone
Open with VS Code Open with VSCodium Open with Intellij IDEA
Download ZIP Download TAR.GZ Download BUNDLE
fenleon 970155a9f0 Simplify README
2026-10-05 00:57:26 +02:00
.github
Add Ko-fi + GitHub Sponsors funding (FUNDING.yml + README header art)
2026-09-29 07:56:05 +02:00
art
Add Ko-fi + GitHub Sponsors funding (FUNDING.yml + README header art)
2026-09-29 07:56:05 +02:00
codec
Live-session port (2026-10-02→04): the packed courier codec (C19 closed — ALPN apns-pack-v1:4096:4096 negotiated live, packed chain anchors at the Apple Server Authentication CA intermediate, no TLS client cert on that path), the <Protocol>-span extraction for wrapped activation responses, the accepted Albert shapes (DeviceCertRequest as <data>(base64(PEM)), three-cert FairPlayCertChain), kebab-case sign-in response + client-id parsing, fresh anisette per SRP run and per 2FA call (the 434/-22421 fixes), the GSA postdata liveness client (fired AFTER the delegate sign-in, ptkn + hb-token binding), and the validation-stamp replay guard (one mint = one device record — the 409's true root cause); nullable next-hbi was already end-to-end
2026-10-05 00:22:45 +02:00
courier
Live-session port (2026-10-02→04): the packed courier codec (C19 closed — ALPN apns-pack-v1:4096:4096 negotiated live, packed chain anchors at the Apple Server Authentication CA intermediate, no TLS client cert on that path), the <Protocol>-span extraction for wrapped activation responses, the accepted Albert shapes (DeviceCertRequest as <data>(base64(PEM)), three-cert FairPlayCertChain), kebab-case sign-in response + client-id parsing, fresh anisette per SRP run and per 2FA call (the 434/-22421 fixes), the GSA postdata liveness client (fired AFTER the delegate sign-in, ptkn + hb-token binding), and the validation-stamp replay guard (one mint = one device record — the 409's true root cause); nullable next-hbi was already end-to-end
2026-10-05 00:22:45 +02:00
crypto
Open Madrid: clean-room Kotlin implementation of Apple's madrid (iMessage) protocol
2026-09-29 00:04:00 +02:00
docs
Live-session port (2026-10-02→04): the packed courier codec (C19 closed — ALPN apns-pack-v1:4096:4096 negotiated live, packed chain anchors at the Apple Server Authentication CA intermediate, no TLS client cert on that path), the <Protocol>-span extraction for wrapped activation responses, the accepted Albert shapes (DeviceCertRequest as <data>(base64(PEM)), three-cert FairPlayCertChain), kebab-case sign-in response + client-id parsing, fresh anisette per SRP run and per 2FA call (the 434/-22421 fixes), the GSA postdata liveness client (fired AFTER the delegate sign-in, ptkn + hb-token binding), and the validation-stamp replay guard (one mint = one device record — the 409's true root cause); nullable next-hbi was already end-to-end
2026-10-05 00:22:45 +02:00
engine
Live-session port (2026-10-02→04): the packed courier codec (C19 closed — ALPN apns-pack-v1:4096:4096 negotiated live, packed chain anchors at the Apple Server Authentication CA intermediate, no TLS client cert on that path), the <Protocol>-span extraction for wrapped activation responses, the accepted Albert shapes (DeviceCertRequest as <data>(base64(PEM)), three-cert FairPlayCertChain), kebab-case sign-in response + client-id parsing, fresh anisette per SRP run and per 2FA call (the 434/-22421 fixes), the GSA postdata liveness client (fired AFTER the delegate sign-in, ptkn + hb-token binding), and the validation-stamp replay guard (one mint = one device record — the 409's true root cause); nullable next-hbi was already end-to-end
2026-10-05 00:22:45 +02:00
gradle
Open Madrid: clean-room Kotlin implementation of Apple's madrid (iMessage) protocol
2026-09-29 00:04:00 +02:00
ids
Live-session port (2026-10-02→04): the packed courier codec (C19 closed — ALPN apns-pack-v1:4096:4096 negotiated live, packed chain anchors at the Apple Server Authentication CA intermediate, no TLS client cert on that path), the <Protocol>-span extraction for wrapped activation responses, the accepted Albert shapes (DeviceCertRequest as <data>(base64(PEM)), three-cert FairPlayCertChain), kebab-case sign-in response + client-id parsing, fresh anisette per SRP run and per 2FA call (the 434/-22421 fixes), the GSA postdata liveness client (fired AFTER the delegate sign-in, ptkn + hb-token binding), and the validation-stamp replay guard (one mint = one device record — the 409's true root cause); nullable next-hbi was already end-to-end
2026-10-05 00:22:45 +02:00
registration
Live-session port (2026-10-02→04): the packed courier codec (C19 closed — ALPN apns-pack-v1:4096:4096 negotiated live, packed chain anchors at the Apple Server Authentication CA intermediate, no TLS client cert on that path), the <Protocol>-span extraction for wrapped activation responses, the accepted Albert shapes (DeviceCertRequest as <data>(base64(PEM)), three-cert FairPlayCertChain), kebab-case sign-in response + client-id parsing, fresh anisette per SRP run and per 2FA call (the 434/-22421 fixes), the GSA postdata liveness client (fired AFTER the delegate sign-in, ptkn + hb-token binding), and the validation-stamp replay guard (one mint = one device record — the 409's true root cause); nullable next-hbi was already end-to-end
2026-10-05 00:22:45 +02:00
.gitignore
Open Madrid: clean-room Kotlin implementation of Apple's madrid (iMessage) protocol
2026-09-29 00:04:00 +02:00
build.gradle.kts
Open Madrid: clean-room Kotlin implementation of Apple's madrid (iMessage) protocol
2026-09-29 00:04:00 +02:00
gradle.properties
Open Madrid: clean-room Kotlin implementation of Apple's madrid (iMessage) protocol
2026-09-29 00:04:00 +02:00
gradlew
Open Madrid: clean-room Kotlin implementation of Apple's madrid (iMessage) protocol
2026-09-29 00:04:00 +02:00
gradlew.bat
Open Madrid: clean-room Kotlin implementation of Apple's madrid (iMessage) protocol
2026-09-29 00:04:00 +02:00
LICENSE
Open Madrid: clean-room Kotlin implementation of Apple's madrid (iMessage) protocol
2026-09-29 00:04:00 +02:00
README.md
Simplify README
2026-10-05 00:57:26 +02:00
settings.gradle.kts
Open Madrid: clean-room Kotlin implementation of Apple's madrid (iMessage) protocol
2026-09-29 00:04:00 +02:00

README.md

Open Madrid

An open implementation of Apple's madrid protocol (iMessage) in Kotlin. Covers the property-list codecs, the APNs "courier" push client, the IDS identity service, the encryption envelope, and the registration/activation chain.

Unlike open-absinthe, which is a mock placeholder with no real code, everything here is readable and Apache-2.0 licensed.

Status

Validated:

  • The parsers handle real Apple bytes. The actual 405-entry IDS bag and 65-entry APNs bag, captured from a registered device, are committed as test fixtures and decoded with exact-value assertions.
  • Two live unauthenticated probes against Apple succeeded: both bag endpoints return plists this stack parses, and certificate pinning validates Apple's real TLS chains. A drift check ships with the repo (:engine:runProbe).
  • The courier's auth model is settled: the TLS handshake succeeds, then the server demands the Albert client certificate (a TLS 1.3 post-handshake certificate_required alert).
  • The registration chain runs end-to-end against scripted Apple responses.
  • The protocol is proven live by a private sibling implementation: a working device-identity chain and, as of 2026-09-29, a full GSA login against Apple's live endpoints (SRP, trusted-device 2FA, PET delivery, delegate sign-in). Those findings are in the spec (rev 25). Apple currently refuses the sign-in with ICLOUD_UNSUPPORTED_DEVICE — a device-identity-bound activation limit, not a protocol gap.

Not validated yet:

  • No real device registration or message send. First live activation is the next milestone.
  • The crypto envelopes have round-trip tests but no known-answer vectors from a live device.
  • A few wire details are capture-bound guesses, tracked in the spec's open-questions checklist.
  • PQ3 is unsupported.

Why another project?

Almost every route to iMessage is closed in some way. Open Madrid is permissively licensed, dependency-light, and fully readable.

Project License / catch
rustpush SSPL
pypush SSPL
imessagego AGPL
BlueBubbles Needs a Mac running 24/7
OpenBubbles Depends on closed-source open-absinthe

Protocol facts live in the spec: docs/imessage-protocol-spec.md.

Contributing

This is a clean-room. Contributors never read the source of rustpush, pypush, imessagego, or their forks. Two roles, kept apart:

  1. Readers study the existing projects. Their only output is the spec.
  2. Writers work only from the spec, Apple's documentation, and recordings of their own device's traffic. Don't open other projects' source or paste their identifiers into commits or issues.

This keeps the code fully open and acceptable to F-Droid and other distribution channels.

Apple material

No Apple-derived code or binary ships here, including the IMDAppleServices framework. The bundled identity in registration/src/main/resources/imessage/fairplay/ is a synthetic placeholder, generated and self-signed, for tests only. Live activation requires Apple's real FairPlay identity, which each user stages themselves.

Building

./gradlew build             # all modules + tests
./gradlew :engine:runProbe  # live drift check

License

Apache-2.0.

Support my work on Ko-fi or GitHub Sponsors.

Reference in new issue View Git Blame Copy Permalink
S
Description
No description provided
androidimessagekotlin
Readme Apache-2.0
1.8 MiB
0 Stars 1 Watchers 0 Forks
Languages
Kotlin 100%