LockdowndHacker

A dynamic library tool for intercepting and modifying responses from the iOS lockdownd service.

Overview

LockdowndHacker hooks the send_response function in lockdownd, allowing developers to intercept, inspect, and modify response data returned by lockdownd at runtime.

Core Features

1. Hook Installation

BOOL InstallSendResponseHook(ResponseTransformCallback callback);

Installs a hook for send_response. A custom callback can be supplied to modify response content.

2. Response Identification and Querying

BOOL ResponseIsGetValue(CFDictionaryRef responseDict, NSDictionary **outValueDict);

Checks whether a response is of the GetValue type and extracts its Value dictionary.

3. Response Modification

Top-Level Key Operations

• CopyResponseWithValue — Replaces a top-level key under Value
• CopyResponseWithValues — Replaces multiple top-level keys under Value
• CopyResponseRemovingValue — Removes a top-level key under Value

Nested Path Operations

• CopyResponseWithPath — Replaces a value at a nested path under Value
• CopyResponseWithPaths — Replaces values at multiple nested paths under Value
• CopyResponseRemovingPath — Removes a nested path under Value

4. Hexadecimal Data Handling

CFDataRef CopyDataFromHexString(NSString *hex, NSError **error);

Supports parsing hexadecimal strings such as "0500", "05 00", and "<05 00>" into CFData.

Available response modification helpers include:

• CopyResponseWithHexValue — Replaces a top-level key value with hexadecimal data
• CopyResponseWithHexPath — Replaces a nested path value with hexadecimal data

Injection

Inject the compiled dynamic library into the lockdownd process using Cydia Substrate.

1. Copy LockdowndHacker.dylib to the Substrate plugin directory on the device:

scp LockdowndHacker.dylib root@DEVICE_IP:/Library/MobileSubstrate/DynamicLibraries/

2. Create the corresponding plist configuration file:

cat > /Library/MobileSubstrate/DynamicLibraries/LockdowndHacker.plist << EOF
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>Filter</key>
    <dict>
        <key>Executables</key>
        <array>
            <string>lockdownd</string>
        </array>
    </dict>
</dict>
</plist>
EOF

3. Restart the lockdownd service to apply the changes:

killall -9 lockdownd

Basic Usage — Modifying the Device Model

// Install the hook and intercept responses
InstallSendResponseHook(^(void *connection, CFDictionaryRef responseDict) {
    // Only process GetValue responses
    if (!ResponseIsGetValue(responseDict, NULL)) {
        return responseDict;
    }
    
    // Change ProductType to iPhone 14 Pro
    return CopyResponseWithValue(responseDict, 
                                 CFSTR("ProductType"), 
                                 CFSTR("iPhone15,2"));
});

Modifying Multiple Fields

InstallSendResponseHook(^(void *connection, CFDictionaryRef responseDict) {
    if (!ResponseIsGetValue(responseDict, NULL)) {
        return responseDict;
    }
    
    NSDictionary *patches = @{
        @"ProductVersion": @"9.0",
        @"ProductType": @"iPhone15,2",
        @"DeviceName": @"TestDevice"
    };
    
    return CopyResponseWithValues(responseDict, patches);
});

Modifying a Nested Path

InstallSendResponseHook(^(void *connection, CFDictionaryRef responseDict) {
    if (!ResponseIsGetValue(responseDict, NULL)) {
        return responseDict;
    }
    
    // Modify a value under a nested Dictionary path
    NSArray *path = @[@"Dictionary", @"NestedKey"];
    return CopyResponseWithPath(responseDict, path, CFSTR("NewValue"));
});

Using Hexadecimal Data

NSError *error = nil;
InstallSendResponseHook(^(void *connection, CFDictionaryRef responseDict) {
    if (!ResponseIsGetValue(responseDict, NULL)) {
        return responseDict;
    }
    
    // Replace a value with hexadecimal data
    return CopyResponseWithHexValue(responseDict, 
                                    CFSTR("SomeData"), 
                                    @"48656c6c6f20576f726c64", 
                                    &error);
});

API Reference

Callback Type

typedef CFDictionaryRef (*ResponseTransformCallback)(void *connection, CFDictionaryRef responseDict);

• Parameters

  • connection: Pointer to the current lockdownd connection object.
  • responseDict: The original response dictionary.

• Return Value

  • Return a new response dictionary to replace the original response.
  • Return NULL to keep the original response unchanged.

Notes

⚠️ Warning

• This tool is intended for debugging and testing purposes only.
• Modifying system service responses may result in unexpected behavior.
• Do not misuse this tool in production environments or on jailbroken devices.
• Back up important data before use.

Contributing

Issues and pull requests are welcome.

Disclaimer: This tool is provided for educational and research purposes only. The author is not responsible for any loss or damage caused by its use.