zerishpho/MGKeys

MobileGestalt Keys (De)obfuscation

MGKeys

Mapping of the obfuscated keys (or questions) used by iOS's MobileGestalt to the de-obfuscated, easier-to-understand ones. To obfuscate a key, Apple calculates the base64 of MGCopyAnswer{theKey}, truncates the last two characters and calculates the MD5 from the resulting string.

It is our job to de-obfuscate them all.

Credits (Keys De-obfuscation)

• Jonathan Levin
• Timac
• Siguza
• Elias Limneos
• PoomSmart
• JackoPlane

Further Readings

• http://newosxbook.com/articles/guesstalt.html by Jonathan Levin
• https://blog.timac.org/2017/0124-deobfuscating-libmobilegestalt-keys/ by Timac
• https://blog.timac.org/2018/1126-deobfuscated-libmobilegestalt-keys-ios-12/ by Timac