I've been spending a good chunk of time looking at some 3rd party applications that were successful in "reproducing" (although I believe not necessarily by understanding the algorithm completely but simply extracting the core of the logic from the original binaries and replicating it into their own programs) the main logic for simulating an Apple TV server with full AirPlay mirroring support, to name a few:
- AirServer (OSX/Windows)
- Reflector (OSX/Windows)
- AirReceiver (Android)
- X-Mirage (OSX/Windows)
- AirPin PRO (Android)
- EZCast Screen (Android)
- Xiaomi Milian (Android/runs on Xiaomi Box)
By looking at their decompiled code and some other references on the web, most of the protocol aspect is already known/relatively easy to figure out and I did it already, so no sweat there, the key part I'm having a tough time understanding how these guys were able to pull it off is related to the FairPlay decryption portion (i.e.: when receiving and responding to the
fp-setup challenges as well as decrypting the AES key sent in the last step of the challenge).
They all seem to have extracted the white-boxed/obfuscated functions out of Apple's original
fairplayd daemon code and embedded it into their source, delegating the calls to seed/encrypt/decrypt to it.
I noticed in some iOS devices this daemon also exist (most likely used to encrypt the feed when mirroring the screen via AirPlay to a compatible server) but was wondering how different this really is from the one shipped with the Apple TV and if my assumptions are actually correct (is that were most of these guys are taking this code from?).
Was hoping either someone with previous experience or a little more knowledge on the topic could shed some light/pointers so I could find a way to at least do the same these guys were able to accomplish (which is not really deobfuscating the code but just extracting it to embed in their own programs).
PS: For clarity, aside from confirmation I was looking for some pointers as to how one would be able to extract compilable code from a said binary, given my attempts at disassembling and decompiling via IDA Pro haven't provided me with much that I can reuse to compile new code that reproduces that piece of the puzzle.