逆向工程 - 识别用于签署 iCloud 负载的算法 - 吾爱随笔录

我正在尝试破译在对 iCloud 备份进行逆向工程时使用哪种算法对特定数据块进行签名。长话短说：我正在尝试找回一些在更换移动服务提供商时丢失的旧语音邮件，这些邮件是在更换 SIM 卡后删除的。iCloud 备份存储旧的语音邮件，所以我认为这可能是一种检索它们的简单方法（我可能有点雄心勃勃;)）。

我正在查看的数据是在请求标头中发送的，并且是 base-64 编码的。它看起来像这样：

AuN9pwI6lGPo4o/QRCHOx2AgLw0+ZYKa/EMrV3mgF3YGAAACsAYAAABRAAAAgODPA2YwKh3l2fLM3gW4Af9xPlv1/+EtbY4h9oARcUPQX4EdH+WAX8Ykm6OHVqd83R66QVIIBHI0tT25B1wFgXuGySqCaaSD0w
Y7gdW2k3D2BvD2nsG5id4t9baDysQJnjb6ZnjKDfcZFN8WtjQrHloMBqKFXo/kFyEcrMe2RRFuAAAByDw/eG1sIHZlcnNpb249IjEuMCIgZW5jb2Rpbmc9IlVURi04Ij8+CjwhRE9DVFlQRSBwbGlzdCBQVUJM
SUMgIi0vL0FwcGxlLy9EVEQgUExJU1QgMS4wLy9FTiIgImh0dHA6Ly93d3cuYXBwbGUuY29tL0RURHMvUHJvcGVydHlMaXN0LTEuMC5kdGQiPgo8cGxpc3QgdmVyc2lvbj0iMS4wIj4KPGRpY3Q+Cgk8a2V5Pn
Byb3RvY29sVmVyc2lvbjwva2V5PgoJPHN0cmluZz4xLjA8L3N0cmluZz4KCTxrZXk+dXNlckluZm88L2tleT4KCTxkaWN0PgoJCTxrZXk+Y2xpZW50LWlkPC9rZXk+CgkJPHN0cmluZz43QzU5NTk2NS1CRjVE
LTRFQUMtODU0Ni1ERjE3MURFODlFODk8L3N0cmluZz4KCQk8a2V5Pmxhbmd1YWdlPC9rZXk+CgkJPHN0cmluZz5lbjwvc3RyaW5nPgoJCTxrZXk+dGltZXpvbmU8L2tleT4KCQk8c3RyaW5nPkFtZXJpY2EvQ2
hpY2Fnbzwvc3RyaW5nPgoJPC9kaWN0Pgo8L2RpY3Q+CjwvcGxpc3Q+CgAAAE8BZcdgyW1geNb3ShFevEjAAQuaxtAAAAA2BwfNJW4CI1ecZzpRj+05iam1VDBu+v6s1vFV2yGsNid5yTyOLs8zP5cDfl9doFgA
ydAAAAAAAAAA=

解码后，我们得到以下（带有相关 Python 代码）：

>>> payload = """AuN9pwI6lGPo4o/QRCHOx2AgLw0+ZYKa/EMrV3mgF3YGAAACsAYAAABRAAAAgODPA2YwKh3l2fLM3gW4Af9xPlv1/+EtbY4h9oARcUPQX4EdH+WAX8Ykm6OHVqd83R66QVIIBHI0tT25B1wFgXuGySqCaaSD0w
Y7gdW2k3D2BvD2nsG5id4t9baDysQJnjb6ZnjKDfcZFN8WtjQrHloMBqKFXo/kFyEcrMe2RRFuAAAByDw/eG1sIHZlcnNpb249IjEuMCIgZW5jb2Rpbmc9IlVURi04Ij8+CjwhRE9DVFlQRSBwbGlzdCBQVUJM
SUMgIi0vL0FwcGxlLy9EVEQgUExJU1QgMS4wLy9FTiIgImh0dHA6Ly93d3cuYXBwbGUuY29tL0RURHMvUHJvcGVydHlMaXN0LTEuMC5kdGQiPgo8cGxpc3QgdmVyc2lvbj0iMS4wIj4KPGRpY3Q+Cgk8a2V5Pn
Byb3RvY29sVmVyc2lvbjwva2V5PgoJPHN0cmluZz4xLjA8L3N0cmluZz4KCTxrZXk+dXNlckluZm88L2tleT4KCTxkaWN0PgoJCTxrZXk+Y2xpZW50LWlkPC9rZXk+CgkJPHN0cmluZz43QzU5NTk2NS1CRjVE
LTRFQUMtODU0Ni1ERjE3MURFODlFODk8L3N0cmluZz4KCQk8a2V5Pmxhbmd1YWdlPC9rZXk+CgkJPHN0cmluZz5lbjwvc3RyaW5nPgoJCTxrZXk+dGltZXpvbmU8L2tleT4KCQk8c3RyaW5nPkFtZXJpY2EvQ2
hpY2Fnbzwvc3RyaW5nPgoJPC9kaWN0Pgo8L2RpY3Q+CjwvcGxpc3Q+CgAAAE8BZcdgyW1geNb3ShFevEjAAQuaxtAAAAA2BwfNJW4CI1ecZzpRj+05iam1VDBu+v6s1vFV2yGsNid5yTyOLs8zP5cDfl9doFgA
ydAAAAAAAAAA="""
>>> decoded_data = payload.decode("base-64")
>>> decoded_data
\x02\xe3}\xa7\x02:\x94c\xe8\xe2\x8f\xd0D!\xce\xc7` /\r>e\x82\x9a\xfcC+Wy\xa0\x17v\x06\x00\x00\x02\xb0\x06\x00\x00\x00Q\x00\x00\x00\x80\xe0\xcf\x03f0*\x1d\xe5\xd9\xf2\xcc\xde\x05\xb8\x01\xffq>[\xf5\xff\xe1-m\x8e!\xf6\x80\x11qC\xd0_\x81\x1d\x1f\xe5\x80_\xc6$\x9b\xa3\x87V\xa7|\xdd\x1e\xbaAR\x08\x04r4\xb5=\xb9\x07\\\x05\x81{\x86\xc9*\x82i\xa4\x83\xd3\x06;\x81\xd5\xb6\x93p\xf6\x06\xf0\xf6\x9e\xc1\xb9\x89\xde-\xf5\xb6\x83\xca\xc4\t\x9e6\xfafx\xca\r\xf7\x19\x14\xdf\x16\xb64+\x1eZ\x0c\x06\xa2\x85^\x8f\xe4\x17!\x1c\xac\xc7\xb6E\x11n\x00\x00\x01\xc8<?xml version="1.0" encoding="UTF-8"?>\n<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">\n<plist version="1.0">\n<dict>\n\t<key>protocolVersion</key>\n\t<string>1.0</string>\n\t<key>userInfo</key>\n\t<dict>\n\t\t<key>client-id</key>\n\t\t<string>7C595965-BF5D-4EAC-8546-DF171DE89E89</string>\n\t\t<key>language</key>\n\t\t<string>en</string>\n\t\t<key>timezone</key>\n\t\t<string>America/Chicago</string>\n\t</dict>\n</dict>\n</plist>\n\x00\x00\x00O\x01e\xc7`\xc9m`x\xd6\xf7J\x11^\xbcH\xc0\x01\x0b\x9a\xc6\xd0\x00\x00\x006\x07\x07\xcd%n\x02#W\x9cg:Q\x8f\xed9\x89\xa9\xb5T0n\xfa\xfe\xac\xd6\xf1U\xdb!\xac6\'y\xc9<\x8e.\xcf3?\x97\x03~_]\xa0X\x00\xc9\xd0\x00\x00\x00\x00\x00\x00\x00

漂亮打印后，它看起来像这样：

>>> print decoded_data
���4+Z+Wy�v�Q���f0*�������q>[���-m�!�qC�_��_�$���V�|��Ar4�=�\�{��*�i���;�ն�p������-��� �6�fx�
      ��^��!�ǶEn�<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>protocolVersion</key>
    <string>1.0</string>
    <key>userInfo</key>
    <dict>
        <key>client-id</key>
        <string>7C595965-BF5D-4EAC-8546-DF171DE89E89</string>
        <key>language</key>
        <string>en</string>
        <key>timezone</key>
        <string>America/Chicago</string>
    </dict>
</dict>
</plist>
Oe�`�m`x��J^�H�
               ���6�%n#W�g:Q��9���T0n�����U�!�6'y�<�.�3?�~_]�X��

由于数据未加密，我假设（可能不正确？）数据前后的数据块代表签名。

有什么方法可以确定可能使用了哪种算法来生成此签名？