sickcodes / Docker-OSX

Run macOS VM in a Docker! Run near native OSX-KVM in Docker! X11 Forwarding! CI/CD for OS X Security Research! Docker mac Containers.
https://hub.docker.com/r/sickcodes/docker-osx
GNU General Public License v3.0
48.79k stars 2.72k forks source link

Recognising iPhone device connected to USB #36

Open osmooth opened 4 years ago

osmooth commented 4 years ago

USB devices are not recognised, a major part of my work requires iPhone connected to device and use it for side loading apps. So I've opened this issue. We are running Qemu inside docker for me "-privileged -v /dev/bus/usb:/dev/bus/usb" didn't work...

sickcodes commented 4 years ago

Yes I am aware of this issue.

If you have a developer cert you can SCP/rsync/sftp the signed ipa back to an nginx server or something and install over the air using manifest.plist.

You can pass the usb iPhone thru but what I’ve noticed is it seems to reject the iPhone until the passcode is entered. Correct me if I’m wrong but there’s a small race to enter the trust this device pin.

You may be on the right track, check out this comment https://sick.codes/how-to-install-macos-virtual-machine-on-linux-arch-manjaro-catalina-mojave-or-high-sierra-xcode-working/#comment-41151

That is all until I add it natively which I aim to do as soon as I finish other work on my plate.

EDIT: see below!


# Linux PC
yay usbfluxd
systemctl restart usbmuxd
avahi-daemon
usbfluxd -f -n
socat tcp-listen:5000,fork unix-connect:/var/run/usbmuxd

# MAC
# get homebrew
brew install make autoheader automake autoconf libtool pkg-config gcc libimobiledevice
# clone & make corellium/usbfluxd
usbfluxd -f -r 192.168.1.X:5000
peterandrewd commented 4 years ago

Tbh I think this should be worked on as a priority. Let’s face it, most people that want to use macOS want to use it simply for Xcode and to sideload.

peterandrewd commented 4 years ago

would be a great set of instructions....except there is no OSX-KVM folder in home/user...

sickcodes commented 4 years ago

Misclicked, will work on this one! It’s doable with the new arguments. Taking a break until mid-week.

peterandrewd commented 4 years ago

Well well after a lot of tinkering I figured out a way to mount USB devices in QEMU (not virt(shit) manager) WITHOUT having to create a new container each time and it’s not just for 1 time use only. You can disconnect it, replug it and still access it. I tested it with 2 different USB drives.

As you can see in the screenshots, the USB drives show up. Still can’t get iPhone mounted though but at least USB drives mount easily now.

image

image

sickcodes commented 4 years ago

That’s also where I got stuck @peterandrewd I can mount it but it doesn’t seem to pass through. However, I can pass it through on VirtualBox windows and sideload apps in Windows. Have you tried the method I described at the start?

You don’t need to connect the USB you can sign it and then install OTA

https://dantheman827.github.io/ios-app-signer/

Sign with that

Then put your IPA on any SSL domain and do an OTA install manifest.plist

https://gist.github.com/hramos/774468

<a href="itms-services://?action=download-manifest&url=https://your.domain.com/your-app/manifest.plist">Awesome App</a>

If you don’t have an SSL domain use this https://github.com/bumaociyuan/ios-ipa-server

peterandrewd commented 4 years ago

That’s also where I got stuck @peterandrewd

I can mount it but it doesn’t seem to pass through. However, I can pass it through on VirtualBox windows and sideload apps in Windows.

Have you tried the method I described at the start?

You don’t need to connect the USB you can sign it and then install OTA

https://dantheman827.github.io/ios-app-signer/

Sign with that

Then put your IPA on any SSL domain and do an OTA install manifest.plist

https://gist.github.com/hramos/774468

<a href="itms-services://?action=download-manifest&url=https://your.domain.com/your-app/manifest.plist">Awesome App</a>

If you don’t have an SSL domain use this https://github.com/bumaociyuan/ios-ipa-server

Ok so I can create a Windows VM and sideload apps that way? How do you sideload using Windows without Xcode? Or are you saying you have a MacOS VM in Windows?

I had tried the OTA method but it seemed too complicated and didn’t work. I got stuck. I’ll try again though but I would appreciate to be guided through it step by step if I get stuck.

peterandrewd commented 4 years ago

Ahhh my iPhone doesn't let me enable full trust certificates in settings. There is no option for it.

--EDIT-- nvm I THINK I got it working. Just have a question. I used the ios ipa server git instructions, and was able to sign and then sideload apps without creating a manifest file as outlined in your first step. So what's the manifest file for if I can sideload using the ios ipa server method? And did I miss something?

sickcodes commented 4 years ago

Oh nice, how’d you side load it? Drag into iTunes?

sickcodes commented 4 years ago

So the Chinese repo skipped everything?? If so that awesome 😂

peterandrewd commented 4 years ago

Oh nice, how’d you side load it? Drag into iTunes?

No. I didn’t use anything but iOS app signer. I just logged into the server ip:port it created on my phones browser and selected the apps to install...? I guess you can try it yourself and verify that it works and that I’m not making any mistake.

peterandrewd commented 4 years ago

Was I right? lol

peterandrewd commented 4 years ago

Was I right? lol

Once again

sickcodes commented 4 years ago

😂 I really liked that repo. It looks like a 1 click signer! I should take some of their code and implement it in this one for a full CI/CD solution.

peterandrewd commented 4 years ago

Sounds good to me. Or update the repo. Cos it doesn’t like look it’s still maintained

sickcodes commented 4 years ago

Good idea

peterandrewd commented 4 years ago

Im full of good ideas

peterandrewd commented 4 years ago

Docker rhymes with Coc*er

reinismu commented 4 years ago

Seems like on solution is to do it like this https://www.reddit.com/r/hackintosh/comments/f31wx0/macos_on_kvm_and_xcode_and_iphone_usb_passthrough/

Sad thing I have only one USB Controller and it is not an option for me :(

VitaminCpp commented 4 years ago

Any news on how to get XCode <-> IPhone USB debugging working? Thanks!

sickcodes commented 4 years ago

I'm pretty sure it can do done.

However, I just add my UDID to my developer account, use https://dantheman827.github.io/ios-app-signer/ and then make a manifest plist and I'm good to go.

This looks like it's the correct answer https://www.reddit.com/r/hackintosh/comments/f31wx0/macos_on_kvm_and_xcode_and_iphone_usb_passthrough/

sickcodes commented 4 years ago

It can be done, checkra1n can do it https://downthecrop.xyz/blog/checkra1n-on-pc-linux-via-qemu-macos-virtualization/

VitaminCpp commented 4 years ago

UDID to my

Yeah, but this way you only can deploy to your IPhone but not debug your app. Am i correct?

VitaminCpp commented 4 years ago

It can be done, checkra1n can do it https://downthecrop.xyz/blog/checkra1n-on-pc-linux-via-qemu-macos-virtualization/

This sounds interesting! Thanks for that hint. I'll have a look onto it. ;-)

mikob commented 3 years ago

Seems like on solution is to do it like this https://www.reddit.com/r/hackintosh/comments/f31wx0/macos_on_kvm_and_xcode_and_iphone_usb_passthrough/

Sad thing I have only one USB Controller and it is not an option for me :(

Tried this. Used this script: https://raw.githubusercontent.com/andre-richter/vfio-pci-bind/master/vfio-pci-bind.sh and intel_iommu=yes, but getting this error when starting the container 😢:

usb_desc_get_descriptor: 1 unknown type 33 (len 10)
qemu-system-x86_64: -device vfio-pci,host=00:14.0: VFIO_MAP_DMA failed: Cannot allocate memory
qemu-system-x86_64: -device vfio-pci,host=00:14.0: vfio 0000:00:14.0: failed to setup container for group 5: memory listener initialization failed: Region pc.ram: vfio_dma_map(0x558158033810, 0x0, 0xa0000, 0x7f3eb2600000) = -12 (Cannot allocate memory)
reinismu commented 3 years ago

Seems like on solution is to do it like this https://www.reddit.com/r/hackintosh/comments/f31wx0/macos_on_kvm_and_xcode_and_iphone_usb_passthrough/ Sad thing I have only one USB Controller and it is not an option for me :(

Tried this. Used this script: https://raw.githubusercontent.com/andre-richter/vfio-pci-bind/master/vfio-pci-bind.sh and intel_iommu=yes, but getting this error when starting the container cry:

usb_desc_get_descriptor: 1 unknown type 33 (len 10)
qemu-system-x86_64: -device vfio-pci,host=00:14.0: VFIO_MAP_DMA failed: Cannot allocate memory
qemu-system-x86_64: -device vfio-pci,host=00:14.0: vfio 0000:00:14.0: failed to setup container for group 5: memory listener initialization failed: Region pc.ram: vfio_dma_map(0x558158033810, 0x0, 0xa0000, 0x7f3eb2600000) = -12 (Cannot allocate memory)

I think I had the same issue and I solved it with setting soft/hard memlock to -1

example:

version: '3.4'

services:
  osx:
    container_name: docker-osx
    image: sickcodes/docker-osx
    privileged: true
    network_mode: "host"
    environment:
      - DISPLAY=${DISPLAY:-:0.0}
      - RAM=8
      # - EXTRA=-device usb-host,hostbus=0x001,hostaddr=0xB # Pass left usb
      # - EXTRA=-device usb-host,vendorid=0x05ac,productid=0x12a8,guest-reset=false # Pass iPhone
      # - EXTRA=-device usb-ehci,id=ehci -device usb-host,bus=ehci.0,vendorid=0x05ac,productid=0x12a8,guest-reset=false
      # - EXTRA=-device ich9-usb-ehci1,id=ehci -device usb-host,bus=ehci.0,vendorid=0x05ac,productid=0x12a8,guest-reset=false
      # - EXTRA=-usb -device usb-host,hostbus=0x1,hostport=0x1,guest-reset=false
      # - EXTRA=-device ich9-usb-ehci1,id=usb,bus=pcie.0,addr=0x7.0x7
      # - EXTRA=-device usb-ehci,id=ehci -device usb-host,bus=ehci.0,hostbus=0x1,hostport=0x1,guest-reset=false
      # - EXTRA=-device vfio-pci,host=0c:00.3 
    # network_mode: "host"
    ports:
      # <Port exposed> : < MySQL Port running inside container>
      - '10022:10022'
    expose:
      # Opens port 3306 on the container
      - '10022'
    ulimits:
      memlock:
        soft: -1
        hard: -1

    cap_add:
      - ALL
    volumes:
      - /tmp/.X11-unix:/tmp/.X11-unix
      - docker-osx_data2:/home
    # entrypoint:
    #   - ./boot-macOS-Catalina.sh

volumes:
  docker-osx_data2:
    name: docker-osx_data

It could be you need to set it on your main machine as well. Can't remember, but if everything with IOMMU groups are correct then that is next thing to look at

sickcodes commented 3 years ago

Great notes @mikob & @reinismu, I'll try adding the iPhone passthrough from your links & code. Aiming for seamlessly using an environment variable. Just fixing up iMessage as we speak!

mikob commented 3 years ago
  # - EXTRA=-device usb-host,hostbus=0x001,hostaddr=0xB # Pass left usb
  # - EXTRA=-device usb-host,vendorid=0x05ac,productid=0x12a8,guest-reset=false # Pass iPhone
  # - EXTRA=-device usb-ehci,id=ehci -device usb-host,bus=ehci.0,vendorid=0x05ac,productid=0x12a8,guest-reset=false
  # - EXTRA=-device ich9-usb-ehci1,id=ehci -device usb-host,bus=ehci.0,vendorid=0x05ac,productid=0x12a8,guest-reset=false
  # - EXTRA=-usb -device usb-host,hostbus=0x1,hostport=0x1,guest-reset=false
  # - EXTRA=-device ich9-usb-ehci1,id=usb,bus=pcie.0,addr=0x7.0x7
  # - EXTRA=-device usb-ehci,id=ehci -device usb-host,bus=ehci.0,hostbus=0x1,hostport=0x1,guest-reset=false
  # - EXTRA=-device vfio-pci,host=0c:00.3

@reinismu, @sickcodes btw, I can only get this working by binding my single usb controller to vfio (which means I lose connection to all my peripherals on the host, including bluetooth which goes through that usb controller) I use the last line you have there commented out -device vfio-pci,host=00:14.0

Do any of these other lines you have commented out work? Curious why they are there. Is it possible to pass a single USB port and not the whole pci controller? So I can retain usage of some peripherals on the host? I tried the README's passthrough method but that didn't work.

reinismu commented 3 years ago

@mikob That was just my testing stuff. I can get it to work only that way as well. (Binding usb to vfio)

sickcodes commented 3 years ago

iPhone passthrough has been solved here: https://github.com/sickcodes/Docker-OSX/issues/133#issuecomment-836855901

I am yet to try it but it is confirmed working.

mikob commented 3 years ago

@sickcodes yes, that's the same thing we've done here, but @reinismu did it first 😛 The shortcoming is that you lose the whole USB controller, and eg. on my laptop there's only one, which apparently has the bluetooth internally routed too. External USB hubs don't show up as different controllers either. So I sacrifice my connection to all the peripherals on the host.

itsam commented 3 years ago

@sickcodes yes, that's the same thing we've done here, but @reinismu did it first 😛 The shortcoming is that you lose the whole USB controller, and eg. on my laptop there's only one, which apparently has the bluetooth internally routed too. External USB hubs don't show up as different controllers either. So I sacrifice my connection to all the peripherals on the host.

Are you able to debug iPhone apps via xcode? Thank you in advance

mikob commented 3 years ago

@itsam yes. Just follow the instructions very carefully here.

Silfalion commented 3 years ago

hey @reinismu @mikob sorry to ping you but writing a PR for iphone passthrough, is it okay if I credit both of you?

mikob commented 3 years ago

@Silfalion fine with me!

reinismu commented 3 years ago

@Silfalion Ye sure

Silfalion commented 3 years ago

Thank you both! Here is the repo:

https://github.com/Silfalion/Iphone_docker_osx_passthrough

Its only very temporary while Sick.Codes checks it to merge it with docker osx.

sickcodes commented 3 years ago

Full OTA iPhone passthrough done too using usbfluxd, today was a good day...

I've added it to the AUR: https://aur.archlinux.org/packages/usbfluxd/

Adding instructions tomorrow...

Wish I had recorded my reaction @peterandrewd

Screenshot_2021-08-26_21-55-12

mikob commented 3 years ago

@sickcodes saw the docs, looks easy to setup. Does this mean that the host no longer needs to sacrifice a USB controller like with the old method?

sickcodes commented 3 years ago

@sickcodes saw the docs, looks easy to setup. Does this mean that the host no longer needs to sacrifice a USB controller like with the old method?

Yes it does :)

Abdelkader-gnichi commented 2 years ago

hi @sickcodes please can u please help me it's about sosumi the snap package i use it to make a catalina qemu and all it's fine but i have a small issue when i plugged in my iphone it does not appear in catalina qemu and i google the problem and i find a solutin but it does't work for me which is https://stackoverflow.com/questions/67279997/connect-iphone-via-usb-to-sosumi-qemu/70474415#70474415 i fellow it but nothing happen -device usb-host,vendorid=0x05ac,productid=0x12a8,guest-reset=false,id=iphone \ i put this line in the launch file in the end and i use this command in my fedora terminal sudo chmod a+w /dev/bus/usb/001/009 of course with the right /usb/00X/00X usb port
and i have this result in the sosumi terminal window while execution : libusb: error [udev_hotplug_event] ignoring udev action bind libusb: error [_get_usbfs_fd] libusb couldn't open USB device /dev/bus/usb/001/047: Operation not permitted libusb: error [_get_usbfs_fd] libusb couldn't open USB device /dev/bus/usb/001/047: Operation not permitted libusb: error [_get_usbfs_fd] libusb couldn't open USB device /dev/bus/usb/001/047: Operation not permitted then i find ur video on YouTube u really doing a good job bro but i'am stuck here with sosumi really i want to try ur solution and i will try it but i want to make it work to do something important then i will switch to ur solution it's mind blowing bro

sickcodes commented 2 years ago

https://github.com/sickcodes/Docker-OSX#usbfluxd-iphone-usb---network-style-passthrough-osx-kvm-docker-osx

https://www.youtube.com/watch?v=kTk5fGjK_PM

wpyoga commented 1 year ago

I have a simpler solution, no need to pass-through the whole USB controller: https://github.com/foxlet/macOS-Simple-KVM/issues/221#issuecomment-1594563753 . Basically, we only need to disable usbmuxd.

I came to this issue looking for a solution, and now I'm contributing back. Hope this helps!

Abdelkader-gnichi commented 1 year ago

I have a simpler solution, no need to pass-through the whole USB controller: https://github.com/foxlet/macOS-Simple-KVM/issues/221#issuecomment-1594563753 . Basically, we only need to disable usbmuxd.

I came to this issue looking for a solution, and now I'm contributing back. Hope this helps!

Nice bro i really appreciate it, thank you so much.