AwesomeREA.org

Tool

Apple Continuity Reverse Engineering Toolkit

Three macOS helpers from SEEMOO Lab that the Open Wireless Link project used to study Apple wireless services such as AirDrop, Wi-Fi Password Sharing, Handoff and Offline Finding from the host side. process_recon summarizes which processes, log categories and subsystems emit log entries matching chosen keywords; keychain_access uses Frida to hook SecItemCopyMatching in a process and exports the keychain items it accesses to JSON; and lldb breakpoint commands print the Handoff and Universal Clipboard messages that the rapportd daemon sends and receives.

Targets
Protocol
Category
Protocol analysis tools
Relationship
Foundation tool
Sources reviewed

Requirements & limits

  • The repository has three commits: the initial release and a paper link on 2021-04-12, and a 2026-08-17 README edit that replaces the former Open Wireless Link website link with a note that the site is no longer associated with the project. There are no releases. The process_recon example was recorded on macOS 11.0 and the breakpoints name private Rapport framework methods; support for current macOS releases is not documented.
  • Runs on the analyst's own Mac with Python 3 in a virtual environment and Node.js; make install installs the pinned requirements, including frida 14.2.7 and frida-tools 9.1.0 from 2021, plus the prettier dev dependency. continuity_messages needs lldb and SIP's debugging protection turned off, and keychain_access needs SIP fully disabled for system processes; the README warns about the security implications.
  • Inputs are the analyst's own devices and accounts: the rapportd examples involve an iPhone next to the Mac and keys for the analyst's iCloud devices, so keychain_access output holds real secrets and should be handled accordingly. keychain_access/tests has small Swift and Objective-C hackme programs and a test.sh that stores and then extracts a dummy keychain password; there are no other tests.
  • The tools watch logs, keychain calls and daemon messages on the host; they do not capture or decode over-the-air Bluetooth LE or AWDL traffic, unlike the separately listed furiousMAC Continuity notes and Wireshark dissector for Continuity advertisements. The README lists the authors' USENIX Security 2021 Continuity and 2019 AWDL papers and a 2020 dissertation as related publications.
  • GPL-3.0. Nothing was installed or run for this review, and the reviewed sources establish no REA connection.

About this entry

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · seemoo-lab/apple-continuity-tools · Revision b93207b
  2. LICENSE GitHub · seemoo-lab/apple-continuity-tools · Revision b93207b
  3. Makefile GitHub · seemoo-lab/apple-continuity-tools · Revision b93207b
  4. requirements.txt GitHub · seemoo-lab/apple-continuity-tools · Revision b93207b
  5. process_recon/README.md GitHub · seemoo-lab/apple-continuity-tools · Revision b93207b
  6. keychain_access/README.md GitHub · seemoo-lab/apple-continuity-tools · Revision b93207b
  7. keychain_access/keychain_access.py GitHub · seemoo-lab/apple-continuity-tools · Revision b93207b
  8. keychain_access/tests/test.sh GitHub · seemoo-lab/apple-continuity-tools · Revision b93207b
  9. continuity_messages/README.md GitHub · seemoo-lab/apple-continuity-tools · Revision b93207b
  10. continuity_messages/packet_breakpoints.txt GitHub · seemoo-lab/apple-continuity-tools · Revision b93207b
  11. https://github.com/seemoo-lab/apple-continuity-tools/commit/b93207b5887c6bef8c9e0e16a442149fb3520e28
  12. https://www.usenix.org/conference/usenixsecurity21/presentation/stute

More in Protocols

All 44 entries in Protocols