Are Background Security Improvements supported?

[Jonathan-David7]

Hey, I was wondering if Background Security Improvements are supported by patching them to an OTA file.
I suppose their mechanism is pretty similar to that of RSRs back in the day? If supported, is the API in ipsw similar?

[blacktop]

ya you use the ipsw ota patch rsr command

Extract the base cryptex volumes from it:

❯ ipsw ota patch rsr <base_ota>.aea --output /tmp/PATCHES/
   • Patching cryptex-app to /tmp/PATCHES/23D8133__iPhone17,1/AppOS/094-25810-058.dmg
   • Patching cryptex-system-arm64e to /tmp/PATCHES/23D8133__iPhone17,1/SystemOS/094-26339-058.dmg

Now apply the BSI patch on top:

❯ ipsw ota patch rsr --input /tmp/PATCHES/23D8133__iPhone17,1/ \
                      --output /tmp/PATCHES/ \
                      <BSI>.aea
   • Patching cryptex-app to /tmp/PATCHES/23D771330a__iPhone17,1/AppOS/043-62774-021.dmg
   • Patching cryptex-system-arm64e to /tmp/PATCHES/23D771330a__iPhone17,1/SystemOS/043-61970-021.dmg

You now have the patched cryptex DMGs. Mount and poke around:

❯ open /tmp/PATCHES/23D771330a__iPhone17,1/SystemOS/043-61970-021.dmg

❯ find /Volumes/*Cryptex*/ -name "dyld_shared_cache*"

[Jonathan-David7]

Cool, I've been trying to use it for some reason fail at the second step, looks like I get a "403 forbidden" error code when trying to access the FCS keys endpoint.
Any idea why that could happen? I'm definitely connected to the internet 😅

This works perfectly:

$ ipsw ota patch rsr 617b068bcc55ff2772ad89023d8bd716a06c19e6c56445f080476aea1ebb29a1.aea --output /tmp/patches
   • Patching cryptex-app to /tmp/patches/23D8133__iPhone14,7/AppOS/094-25810-058.dmg
   • Patching cryptex-system-arm64e to /tmp/patches/23D8133__iPhone14,7/SystemOS/094-26292-058.dmg

This fails for some reason:

$ ipsw ota patch rsr --input /tmp/patches/23D8133__iPhone14,7 --output /tmp/patches bd39de22c2375a1eafa35ed2b50dc6a5fb8957f31dff7d3b59425b975bed257b.aea
Usage:
  ipsw ota patch rsr [flags]

Aliases:
  rsr, r

Flags:
  -c, --cryptex string          Cryptex file from OTA
  -a, --dyld-arch stringArray   dyld_shared_cache architecture to extract
  -h, --help                    help for rsr
  -i, --input string            Input folder
  -o, --output string           Output folder

Global Flags:
      --color            colorize output
      --config string    config file (default is $HOME/.config/ipsw/config.yaml)
      --insecure         Allow insecure connections when fetching AEA keys
      --key-db string    Path to AEA keys JSON database (auto-lookup by filename)
      --key-val string   Base64 encoded AEA symmetric encryption key
      --no-color         disable colorize output
  -V, --verbose          verbose output

   ⨯ failed to open OTA: failed to decrypt AEA: failed to HPKE decrypt fcs-key: failed to connect to fcs-key URL: 403 Forbidden (try providing --key-val, --key-db, or ensure you're online for automatic key lookup)

Also, thanks for the detailed reply! 🙏