lockdownd is a daemon that provides system information to clients using liblockdown.dylib, e.g. the IMEI, UDID, etc. Every information provided by lockdownd can be obtained via other means, e.g. the IMEI can be found using IOKit. The only advantage of using lockdownd is it has root privilege, hence avoiding having to assume super user.
Data Ark
Non-default information of lockdownd is stored in the data ark as a dictionary in /var/root/Library/Lockdown/data_ark.plist. The keys are represented as domain-key, e.g. com.apple.mobile.iTunes.store-AppleID.
SSL
lockdownd communicates with its clients via a UNIX socket /var/run/lockdown/localcomm with SSLv3 encryption. The contents exchanged are encoded property lists. Clients will initiate an action with a plist message like this:
Request = action; ProtocolVersion = "2"; Label = execName; Domain = domain; Key = key; ...
Server may response with
Error = errMsg; Value = value; ...
lockdownd understands the following actions:
- ServiceCheckin
- Goodbye
- RemoveValue
- SetValue
- GetValue
UDID
The UDID is not an internal property. It is computed with this formula:
| “ | UDID = SHA1(SerialNumber + IMEI + WiFiAddress + BluetoothAddress) | ” |
where "+" means string concatenation. For iPod Touch 1G (iPod1,1), WiFiAddress is always 00:00:00:00:00:00 in this formula. If any of these values are missing (e.g. there is no IMEI in iPods), they will be treated as an empty string.