AppAttest - Invalid appUUID

Question

beetlab OP

Created May ’23

Replies 0

Boosts 0

Participants 1

Hi!

I'm generating assertions using DCAppAttestService.shared.generateAssertion. It's running for almost one and a half years and has the following issue. Approx 6% of our users trying to generate assertions have issues and according to our analytics about half of them have invalid_input error during assertion process). I've managed to reproduce this issue on test device and noticed some weird scenario:

(first app run)

The AppAttest key generated and attested at Apple side successfully. Key Identifier persisted.
Attestation object verification on backend and public key extraction is ok
Unlimited number of assertion can be generated this time

(second app run)

Key Identifier persisted on previous app run is read and passed to DCAppAttestService.shared.generateAssertion
Invalid input error received.
Regeneration of key and attestation works fine.

So looks like there is a kinda state in assertion process - it works well after key generation on first run, but fails with invalid_input on second run.

As invalid_input error cannot say much about the issue, I've swizzled some methods of DCAppAttestService (https://developer.limneos.net/index.php?ios=15.2.1&framework=DeviceCheck.framework&header=DCAppAttestService.h) - _rewrapAsDCError, _loadAppUUID, _saveAppUUID. Swizzling implementation attached (swizzling.swift). As the swizzling logs show - when invalid_input raises, a strange error is printed (Error Domain=com.apple.appattest.error Code=-2 "Invalid appUUID" UserInfo={NSLocalizedDescription=Invalid appUUID}).

What can be the issue? In another app this behaviour isn't reproducible but they share similar dependency with App Attest - wrapping logic I've filed bug report no FB12205670. Thanks.

Logs:

ok case:

key generation:

swizzleLoadAppID 
swizzleSaveAppID EDA165DC-0781-4891-A16D-0979FC4FEB84
swizzleRewrap 

key attestation: (key_id: "XzTjW3V7944\&#x2F;ljQ2C8LTpqug0t0gslVyhdWGUCnJXfY=")

swizzleLoadAppID EDA165DC-0781-4891-A16D-0979FC4FEB84
swizzleRewrap 

key assertion: (input key_id =  "XzTjW3V7944\&#x2F;ljQ2C8LTpqug0t0gslVyhdWGUCnJXfY=" clientDataHash = "zUwl\&#x2F;jiunewwd1ofhEOmgNGWM+oD7LmUGe6Te5Iv9pc=")

swizzleLoadAppID EDA165DC-0781-4891-A16D-0979FC4FEB84
swizzleRewrap 

issue case (DCError.invalid_input):

key assertion: (input key_id =  "XzTjW3V7944\&#x2F;ljQ2C8LTpqug0t0gslVyhdWGUCnJXfY=" clientDataHash = "F8o5i+8PsZ5cTuyjlZoMe+kcbTG0\&#x2F;R8Vw6tmjPlzlLc=")
swizzleLoadAppID 
swizzleRewrap Error Domain=com.apple.appattest.error Code=-2 "Invalid appUUID" UserInfo={NSLocalizedDescription=Invalid appUUID}

Swizzling logic:

    @objc func swizzleRewrap(obj: NSObject) -> NSObject {
        let returnValue = swizzleRewrap(obj: obj)
        print("swizzleRewrap \(obj)")
        return returnValue
    }

    @objc func swizzleLoadAppID() -> NSObject {
        let returnValue = swizzleLoadAppID()
        print("swizzleLoadAppID \(returnValue.debugDescription)")
        return returnValue
    }

    @objc func swizzleSaveAppID(app_id: NSObject) {
        swizzleSaveAppID(app_id: app_id)
        print("swizzleSaveAppID \(app_id)")
    }

    static func makeSwizzling() {
        let sel = NSSelectorFromString("_rewrapAsDCError:")
        DCAppAttestService.swizzleInstanceMethod(sel, #selector(DCAppAttestService.swizzleRewrap(obj:)))
        let sel1 = NSSelectorFromString("_loadAppUUID")
        DCAppAttestService.swizzleInstanceMethod(sel1, #selector(DCAppAttestService.swizzleLoadAppID))
        let sel2 = NSSelectorFromString("_saveAppUUID:")
        DCAppAttestService.swizzleInstanceMethod(sel2, #selector(DCAppAttestService.swizzleSaveAppID(app_id:)))
    }
}

public extension NSObjectProtocol {
    static func swizzleInstanceMethod(_ origin: Selector, _ replace: Selector) {
        let origin = class_getInstanceMethod(self, origin)
        let replace = class_getInstanceMethod(self, replace)

        if let origin = origin, let replace = replace {
            method_exchangeImplementations(origin, replace)
        }
    }
}

Boost