@sskaje

Instagram iOS Signature Algorithm (ig_sig_key_version=5)

By @sskaje
Link: https://sskaje.me/2017/07/instagram-ios-signature-algorithm-ig_sig_key_version5/

ig_sig_key_version=4的到处都是。
ig_sig_key_version=5的没找到。

你知道是HMAC-SHA256。

所以，你以为是 4749bda4fc1f49372dae3d79db339ce4959cfbbe ？

那你被骗了。

You are not authorised to read all content in this post.

Please login…

Instagram iOS Signature Algorithm (ig_sig_key_version=5) by @sskaje: https://sskaje.me/2017/07/instagram-ios-signature-algorithm-ig_sig_key_version5/

iOS 8/9 SDK

By @sskaje
Link: https://sskaje.me/2017/07/ios-89-sdk/

Xcode 8.3.3 自带的iPhone SDK不支持32位的armv7和armv7s了。想在越狱的iPhone 4s搞点小玩意儿，但是make时提示 -lcrt1.3.1.o 出错。所以研究了下怎么把老版本SDK安装上，最后发现还是只能从老版本的Xcode上提取。

Xcode 7.3.1是7系列最后一个版本，自带的SDK是 iPhoneOS9.3.sdk，Xcode 6.4是6系列最后一个版本，自带的SDK是 iPhone8.4.sdk。
提取时只需要把dmg里 Xcode.app/Contents/Developer/Platforms/iPhoneOS.platform/Developer/SDKs 下的目录copy到当前系统安装的Xcode的同一目录里，但是别用旧版本覆盖了新版本。

下载地址：https://dl.sskaje.me/ios-sdks/

下载执行

sudo tar -C /Applications/Xcode.app/Contents/Developer/Platforms/iPhoneOS.platform/Developer/SDKs/ -xvf iPhoneOS9.3.sdk.tar.gz

1	sudo tar -C /Applications/Xcode.app/Contents/Developer/Platforms/iPhoneOS.platform/Developer/SDKs/ -xvf iPhoneOS9.3.sdk.tar.gz

iOS 8/9 SDK by @sskaje: https://sskaje.me/2017/07/ios-89-sdk/

Set up iOS SSH over USB with MacPorts

By @sskaje
Link: https://sskaje.me/2017/07/set-up-ios-ssh-over-usb-with-macports/

文档在：http://iphonedevwiki.net/index.php/SSH_Over_USB

提供了homebrew的安装方式。这里给一下MacPorts下的安装方式。

sudo port install opam ocaml ocaml-camlp4

1	sudo port install opam ocaml ocaml-camlp4

安装过程可能会进入opam的初始化状态，如果没有的化，可以手工执行

opam init

opam init

慢的时候不要急着回车，中间会有需要输入y确认的选项

opam install usbmux

1	opam install usbmux

gandalf的新版mapping配置用的是json，跟wiki描述的已经不一致了。

手机连上电脑，直接执行gandalf

$ gandalf 
Device 30 with serial number: 00112233445566778899aabbccddeeff00112233 connected

1 2	$ gandalf Device 30 with serial number: 00112233445566778899aabbccddeeff00112233 connected

编辑 mapping.json，内容如下

[
  {
    "udid": "00112233445566778899aabbccddeeff00112233",
    "name": "i11",
    "forwarding": [
      {
        "local_port": 10022,
        "device_port": 22
      },
      {
        "local_port": 19988,
        "device_port": 9988
      }
    ]
  }
]

[

{

"udid": "00112233445566778899aabbccddeeff00112233",

"name": "i11",

"forwarding": [

{

"local_port": 10022,

"device_port": 22

{

"local_port": 19988,

"device_port": 9988

}

]

}

]

其中：udid与上边直接执行命令时拿到的结果须一致；name自定义；forwarding里的local_port是本地开的端口，device_port是远程的端口。
按这份配置，我可以直接使用 ssh -p 10022 root@127.0.0.1 连接到iPhone的22端口。

执行下列命令，启动gandalf。

gandalf -m mapping.json

1	gandalf -m mapping.json

Set up iOS SSH over USB with MacPorts by @sskaje: https://sskaje.me/2017/07/set-up-ios-ssh-over-usb-with-macports/

20分钟搭建一个自用的DDNS服务

By @sskaje
Link: https://sskaje.me/2017/07/set-up-simple-ddns-server-in-20-minutes/

08年的时候，在学校，花了点时间做了个ddns服务，不知道现在是否还活着，ddns.bitunion.org。
当时的方案，powerdns + mysql + php ui，php ui是自己做的，简单地做了个校内邮箱的校验，使用了个简单的token机制来更新记录。

这回，有个需求是需要做一个ttl < 10的ddns服务，之前所有域名都在dns.he.net上，最小ttl限制到了300，这样以来，更新的延迟特定场景下不够用。 自用DDNS的需求里，域名不会被广泛知晓并使用，否则NS服务器的压力会是个问题。

方案还是一样，powerdns + mysql，写了个最简单的http接口页面给ddclient用。

服务器是 ubuntu 17.04，公网IP 1.2.3.4.
目标域名 xxx.ddns.sskaje.me

安装软件

按下列命令安装必备软件，全默认

apt install  pdns-server pdns-tools pdns-backend-mysql

1	apt install pdns-server pdns-tools pdns-backend-mysql

配置powerdns

考虑到现在的linux服务器，本地53端口经常被占用，所以需要修改 /etc/powerdns/pdns.conf，指定监听的IP

local-address=1.2.3.4

1	local-address=1.2.3.4

配置zone和records

在sskaje.me的域名服务器上，添加NS记录 ddns.sskaje.me，指向IP 1.2.3.4。考虑到未来可能改IP，可以加一个A记录 ddns1.sskaje.me，指向 1.2.3.4，这样ddns.sskaje.me的NS设置成 ddns1.sskaje.me。

创建zone

# pdnsutil create-zone ddns.sskaje.me
Jul 16 08:59:55 [bindbackend] Done parsing domains, 0 rejected, 0 new, 0 removed
Creating empty zone 'ddns.sskaje.me'

# pdnsutil create-zone ddns.sskaje.me

Jul 16 08:59:55 [bindbackend] Done parsing domains, 0 rejected, 0 new, 0 removed

Creating empty zone 'ddns.sskaje.me'

更正SOA记录

# pdnsutil add-record ddns.sskaje.me @  SOA 2592000 "dns.sskaje.me. dns.sskaje.me. 1 10800 3600 604800 3600"
Jul 16 09:13:47 [bindbackend] Done parsing domains, 0 rejected, 0 new, 0 removed
New rrset:
ddns.sskaje.me. IN SOA 3600 a.misconfigured.powerdns.server hostmaster.ddns.sskaje.me 1 10800 3600 604800 3600
ddns.sskaje.me. IN SOA 2592000 dns.sskaje.me dns.sskaje.me 1 10800 3600 604800 3600

# pdnsutil add-record ddns.sskaje.me @ SOA 2592000 "dns.sskaje.me. dns.sskaje.me. 1 10800 3600 604800 3600"

Jul 16 09:13:47 [bindbackend] Done parsing domains, 0 rejected, 0 new, 0 removed

New rrset:

ddns.sskaje.me. IN SOA 3600 a.misconfigured.powerdns.server hostmaster.ddns.sskaje.me 1 10800 3600 604800 3600

ddns.sskaje.me. IN SOA 2592000 dns.sskaje.me dns.sskaje.me 1 10800 3600 604800 3600

添加 xxx.ddns.sskaje.me，设置ttl=10

# pdnsutil add-record ddns.sskaje.me xxx A 10 127.0.0.1
Jul 16 09:14:55 [bindbackend] Done parsing domains, 0 rejected, 0 new, 0 removed
New rrset:
xxx.ddns.sskaje.me. IN A 10 127.0.0.1

# pdnsutil add-record ddns.sskaje.me xxx A 10 127.0.0.1

Jul 16 09:14:55 [bindbackend] Done parsing domains, 0 rejected, 0 new, 0 removed

New rrset:

xxx.ddns.sskaje.me. IN A 10 127.0.0.1

简单的更新脚本

DynDNS的更新接口参数类似：

/nic/update?system=dyndns&hostname=xxx.ddns.sskaje.me&myip=4.3.2.1

1	/nic/update?system=dyndns&hostname=xxx.ddns.sskaje.me&myip=4.3.2.1

认证使用 http basic auth 完成的。

所以一个简单的服务端脚本

<?php

$auth = [
    'xxx.ddns.sskaje.me' =>  'This.15.p4ssw0rd',
];


if (!isset($_SERVER['PHP_AUTH_USER']) || !isset($_SERVER['PHP_AUTH_PW'])) {
    die('badauth');
}

if (!isset($auth[$_SERVER['PHP_AUTH_USER']])) {
    die('badauth');
}

if ($auth[$_SERVER['PHP_AUTH_USER']] != $_SERVER['PHP_AUTH_PW']) {
    die('badauth');
}

if (!isset($_GET['hostname'])) {
    die('badauth');
}

if ($_GET['hostname'] != $_SERVER['PHP_AUTH_USER']) {
    die('badauth');
}

$db = new mysqli('localhost', 'root', '123123123', 'pdns');
$db->set_charset('utf8');
try {
    $db->autocommit(0);

    $result = $db->query("SELECT * FROM records WHERE name='{$_SERVER['PHP_AUTH_USER']}' FOR UPDATE ");

    if (!$result->num_rows) {
        throw new Exception('nohost');
    }

    $record = $result->fetch_assoc();
    if ($record['type'] != 'A') {
        throw new Exception('nohost');
    }

    if (!isset($_GET['myip'])) {
        $ip = get_client_ip();
    } else {
        $ip = long2ip(ip2long($_GET['myip']));
    }

    if ($ip == $record['content']) {
        throw new Exception('nochg');
    }

    $db->query("UPDATE records SET content='{$ip}' WHERE id={$record['id']}");

    $db->commit();

    echo "good {$ip}\n";

} catch (Exception $e) {
    $db->rollback();

    echo $e->getMessage() . "\n";
} finally {
    $db->close();
}

function get_client_ip()
{
    if (isset($_SERVER['HTTP_CF_CONNECTING_IP'])) {
        return $_SERVER['HTTP_CF_CONNECTING_IP'];
    }

    return $_SERVER['REMOTE_ADDR'];
}

<?php

$auth = [

'xxx.ddns.sskaje.me' => 'This.15.p4ssw0rd',

];

if (!isset($_SERVER['PHP_AUTH_USER']) || !isset($_SERVER['PHP_AUTH_PW'])) {

die('badauth');

}

if (!isset($auth[$_SERVER['PHP_AUTH_USER']])) {

die('badauth');

}

if ($auth[$_SERVER['PHP_AUTH_USER']] != $_SERVER['PHP_AUTH_PW']) {

die('badauth');

}

if (!isset($_GET['hostname'])) {

die('badauth');

}

if ($_GET['hostname'] != $_SERVER['PHP_AUTH_USER']) {

die('badauth');

}

$db = new mysqli('localhost', 'root', '123123123', 'pdns');

$db->set_charset('utf8');

try {

$db->autocommit(0);

$result = $db->query("SELECT * FROM records WHERE name='{$_SERVER['PHP_AUTH_USER']}' FOR UPDATE ");

if (!$result->num_rows) {

throw new Exception('nohost');

}

$record = $result->fetch_assoc();

if ($record['type'] != 'A') {

throw new Exception('nohost');

}

if (!isset($_GET['myip'])) {

$ip = get_client_ip();

} else {

$ip = long2ip(ip2long($_GET['myip']));

}

if ($ip == $record['content']) {

throw new Exception('nochg');

}

$db->query("UPDATE records SET content='{$ip}' WHERE id={$record['id']}");

$db->commit();

echo "good {$ip}\n";

} catch (Exception $e) {

$db->rollback();

echo $e->getMessage() . "\n";

} finally {

$db->close();

}

function get_client_ip()

{

if (isset($_SERVER['HTTP_CF_CONNECTING_IP'])) {

return $_SERVER['HTTP_CF_CONNECTING_IP'];

}

return $_SERVER['REMOTE_ADDR'];

}

20分钟搭建一个自用的DDNS服务 by @sskaje: https://sskaje.me/2017/07/set-up-simple-ddns-server-in-20-minutes/

EdgeRouter 部署 WireGuard

By @sskaje
Link: https://sskaje.me/2017/06/deploy-wireguard-on-edgerouter/

安装

从 https://github.com/Lochnair/vyatta-wireguard/releases 下载对应的包
ERL, ER等 mips架构的，下载 octeon 版本
ERX 下载 ralink版本。

可以选择上传到路由上，或者ssh登录路由，sudo su到root，执行类似如下的命令

curl https://github.com/Lochnair/vyatta-wireguard/releases/download/0.0.20170612-2/wireguard-octeon-0.0.20170612-2.deb -o wireguard-octeon-0.0.20170612-2.deb

1	curl https://github.com/Lochnair/vyatta-wireguard/releases/download/0.0.20170612-2/wireguard-octeon-0.0.20170612-2.deb -o wireguard-octeon-0.0.20170612-2.deb

或

curl https://github.com/Lochnair/vyatta-wireguard/releases/download/0.0.20170612-2/wireguard-ralink-0.0.20170612-2.deb -o wireguard-ralink-0.0.20170612-2.deb

1	curl https://github.com/Lochnair/vyatta-wireguard/releases/download/0.0.20170612-2/wireguard-ralink-0.0.20170612-2.deb -o wireguard-ralink-0.0.20170612-2.deb

下载完成后

dpkg -i xxx.deb

1	dpkg -i xxx.deb

配置

执行下列命令生成私钥、共享密钥，公钥

wg genkey > /config/auth/wg.private
wg genpsk > /config/auth/wg.psk
chmod 0600 /config/auth/wg.*
wg pubkey < /config/auth/wg.private

wg genkey > /config/auth/wg.private

wg genpsk > /config/auth/wg.psk

chmod 0600 /config/auth/wg.*

wg pubkey < /config/auth/wg.private

将最后一个命令的输出复制下来，配置到服务器端

获取服务器端的公钥，替换下文的“公钥”并执行命令

configure
set interfaces wireguard wg0 address 192.168.10.40/24
set interfaces wireguard wg0 listen-port 本地端口
set interfaces wireguard wg0 peer 公钥 allowed-ips 0.0.0.0/0
set interfaces wireguard wg0 peer 公钥 endpoint '服务器IP:端口'
set interfaces wireguard wg0 peer 公钥 preshared-key /config/auth/wg-eos.psk
set interfaces wireguard wg0 private-key /config/auth/wg.private
set interfaces wireguard wg0 route-allowed-ips false
commit
save

configure

set interfaces wireguard wg0 address 192.168.10.40/24

set interfaces wireguard wg0 listen-port 本地端口

set interfaces wireguard wg0 peer 公钥 allowed-ips 0.0.0.0/0

set interfaces wireguard wg0 peer 公钥 endpoint '服务器IP:端口'

set interfaces wireguard wg0 peer 公钥 preshared-key /config/auth/wg-eos.psk

set interfaces wireguard wg0 private-key /config/auth/wg.private

set interfaces wireguard wg0 route-allowed-ips false

commit

save

配置好设备后，配置nat服务

configure
set service nat rule 5032 outbound-interface wg0
set service nat rule 5032 type masquerade
commit 
save

configure

set service nat rule 5032 outbound-interface wg0

set service nat rule 5032 type masquerade

commit

save

剩下就是配置路由规则了，可以参考我的其他blog.

EdgeRouter 部署 WireGuard by @sskaje: https://sskaje.me/2017/06/deploy-wireguard-on-edgerouter/