MobileDevice Library

From The Apple Wiki

MobileDevice Library is used by iTunes to transfer data between iPhone and computer over both USB and WiFi connections.

MobileDevice.framework[edit source]

macOS: MobileDevice.framework[edit source]

  • Location: /System/Library/PrivateFrameworks/MobileDevice.framework
  • Export command: nm /System/Library/PrivateFrameworks/MobileDevice.framework/Versions/A/MobileDevice

Windows: MobileDevice.dll[edit source]

iTunes Version AMDS location AAS location 32-bit DLLs 64-bit DLLs
32-bit iTunes 64-bit iTunes
7.0 - 7.5 Use hardcoded path
Use hardcoded path Yes
7.6 - 8.2 Yes Yes
9.0 - 12.0 Use registry key
Use registry key
12.1 - 12.4 Only with "older
video cards" variant
12.5 No
12.6 - Yes - Use AMDS registry key

For iTunes 7.0 - 8.2, load the dll directly from %ProgramFiles%\Common Files\Apple\Mobile Device Support\iTunesMobileDevice.dll (%ProgramFiles(x86)% on 64-bit Windows). Supporting CoreFoundation.dll (used for CFStringRef, CFPropertyListRef management) is located at the same path.

Starting with iTunes 9.0, the location of MobileDevice.dll (no longer prefixed with "iTunes") is stored in InstallDir registry value under HKLM\SOFTWARE\Apple Inc.\Apple Mobile Device Support registry key, and CoreFoundation.dll is stored in InstallDir registry value under HKLM\SOFTWARE\Apple Inc.\Apple Application Support registry key.

Starting with iTunes 12.1, the 64-bit variant of iTunes (identified by an installer filename of iTunes6464Setup.exe) includes only 64-bit binaries. This breaks compatibility with third-party 32-bit tools, as the 32-bit dlls they require simply no longer exist. Between iTunes 12.1 and 12.4, due to a bug where 64-bit iTunes would fail to play video on certain graphics cards, a "64-bit - for older video cards" variant (iTunes64Setup.exe) was separately made available on the Apple Support website, which restored the full set of 32-bit binaries. No "older video cards" release was made for iTunes 12.5. This change was rolled back with iTunes 12.6.

Starting with iTunes, Apple Application Support was merged into Apple Mobile Device Support. Hence, paths and registry keys relating to Apple Application support no longer exist. Should your program find these paths not exist, you can assume CoreFoundation.dll can be found at the same path as Apple Mobile Device Support.

Library Interfaces[edit source]

  • libimobiledevice (provides the same functionality on GNU/Linux)
  • mobiledevice (command line utility for interacting with MobileDevice Framework)
  • SDMMobileDevice (OS X framework written in C that can be used interchangeably with Apple's private framework MobileDevice.framework)
  • MobileDeviceAccess Archived 2014-07-03 at the Wayback Machine (similar to above, but written in Objective-C)
  • MobileDevice.h (old reverse engineered header for interfacing with MobileDevice library)

Private Functions[edit source]

Obtaining address[edit source]

In order to obtain the address of a usable private function in MobileDevice, you will have to be able to understand x86-64 assembly to reverse engineer it. These methods differ slightly based on platform due to how dynamically linked libraries handle position independent code.

Mac OS X (MobileDevice.framework)[edit source]

A private function is not marked as exported in the mach-o symbol table. This means it cannot be called by simply linking against the library. To call unexported functions, the mach-o symbol table must be stepped through manually to find the offset of a particular function call. Calls can be verified by checking against the offset of the name inside the name table.

Windows (MobileDevice.dll)[edit source]

Unlike OS X's dynamically linkable libraries, Windows dynamic libraries do not support position independent code in the same manner. A private function will not have its name in the exported symbol table, so in a debugger, like GDB, it will show up as part of another function. However, you will know that it is a separate function as a new stack frame is set up.

Known Error Codes[edit source]

MobileDevice Error Code Listing
  • kAMDSuccess = 0x0
  • kAMDUndefinedError = 0xe8000001
  • kAMDBadHeaderError = 0xe8000002
  • kAMDNoResourcesError = 0xe8000003
  • kAMDReadError = 0xe8000004
  • kAMDWriteError = 0xe8000005
  • kAMDUnknownPacketError = 0xe8000006
  • kAMDInvalidArgumentError = 0xe8000007
  • kAMDNotFoundError = 0xe8000008
  • kAMDIsDirectoryError = 0xe8000009
  • kAMDPermissionError = 0xe800000a
  • kAMDNotConnectedError = 0xe800000b
  • kAMDTimeOutError = 0xe800000c
  • kAMDOverrunError = 0xe800000d
  • kAMDEOFError = 0xe800000e
  • kAMDUnsupportedError = 0xe800000f
  • kAMDFileExistsError = 0xe8000010
  • kAMDBusyError = 0xe8000011
  • kAMDCryptoError = 0xe8000012
  • kAMDInvalidResponseError = 0xe8000013
  • kAMDMissingKeyError = 0xe8000014
  • kAMDMissingValueError = 0xe8000015
  • kAMDGetProhibitedError = 0xe8000016
  • kAMDSetProhibitedError = 0xe8000017
  • kAMDRemoveProhibitedError = 0xe8000018
  • kAMDImmutableValueError = 0xe8000019
  • kAMDPasswordProtectedError = 0xe800001a
  • kAMDMissingHostIDError = 0xe800001b
  • kAMDInvalidHostIDError = 0xe800001c
  • kAMDSessionActiveError = 0xe800001d
  • kAMDSessionInactiveError = 0xe800001e
  • kAMDMissingSessionIDError = 0xe800001f
  • kAMDInvalidSessionIDError = 0xe8000020
  • kAMDMissingServiceError = 0xe8000021
  • kAMDInvalidServiceError = 0xe8000022
  • kAMDInvalidCheckinError = 0xe8000023
  • kAMDCheckinTimeoutError = 0xe8000024
  • kAMDMissingPairRecordError = 0xe8000025
  • kAMDInvalidActivationRecordError = 0xe8000026
  • kAMDMissingActivationRecordError = 0xe8000027
  • kAMDWrongDroidError = 0xe8000028
  • kAMDSUVerificationError = 0xe8000029
  • kAMDSUPatchError = 0xe800002a
  • kAMDSUFirmwareError = 0xe800002b
  • kAMDProvisioningProfileNotValid = 0xe800002c
  • kAMDSendMessageError = 0xe800002d
  • kAMDReceiveMessageError = 0xe800002e
  • kAMDMissingOptionsError = 0xe800002f
  • kAMDMissingImageTypeError = 0xe8000030
  • kAMDDigestFailedError = 0xe8000031
  • kAMDStartServiceError = 0xe8000032
  • kAMDInvalidDiskImageError = 0xe8000033
  • kAMDMissingDigestError = 0xe8000034
  • kAMDMuxError = 0xe8000035
  • kAMDApplicationAlreadyInstalledError = 0xe8000036
  • kAMDApplicationMoveFailedError = 0xe8000037
  • kAMDApplicationSINFCaptureFailedError = 0xe8000038
  • kAMDApplicationSandboxFailedError = 0xe8000039
  • kAMDApplicationVerificationFailedError = 0xe800003a
  • kAMDArchiveDestructionFailedError = 0xe800003b
  • kAMDBundleVerificationFailedError = 0xe800003c
  • kAMDCarrierBundleCopyFailedError = 0xe800003d
  • kAMDCarrierBundleDirectoryCreationFailedError = 0xe800003e
  • kAMDCarrierBundleMissingSupportedSIMsError = 0xe800003f
  • kAMDCommCenterNotificationFailedError = 0xe8000040
  • kAMDContainerCreationFailedError = 0xe8000041
  • kAMDContainerP0wnFailedError = 0xe8000042
  • kAMDContainerRemovalFailedError = 0xe8000043
  • kAMDEmbeddedProfileInstallFailedError = 0xe8000044
  • kAMDErrorError = 0xe8000045
  • kAMDExecutableTwiddleFailedError = 0xe8000046
  • kAMDExistenceCheckFailedError = 0xe8000047
  • kAMDInstallMapUpdateFailedError = 0xe8000048
  • kAMDManifestCaptureFailedError = 0xe8000049
  • kAMDMapGenerationFailedError = 0xe800004a
  • kAMDMissingBundleExecutableError = 0xe800004b
  • kAMDMissingBundleIdentifierError = 0xe800004c
  • kAMDMissingBundlePathError = 0xe800004d
  • kAMDMissingContainerError = 0xe800004e
  • kAMDNotificationFailedError = 0xe800004f
  • kAMDPackageExtractionFailedError = 0xe8000050
  • kAMDPackageInspectionFailedError = 0xe8000051
  • kAMDPackageMoveFailedError = 0xe8000052
  • kAMDPathConversionFailedError = 0xe8000053
  • kAMDRestoreContainerFailedError = 0xe8000054
  • kAMDSeatbeltProfileRemovalFailedError = 0xe8000055
  • kAMDStageCreationFailedError = 0xe8000056
  • kAMDSymlinkFailedError = 0xe8000057
  • kAMDiTunesArtworkCaptureFailedError = 0xe8000058
  • kAMDiTunesMetadataCaptureFailedError = 0xe8000059
  • kAMDAlreadyArchivedError = 0xe800005a
  • kAMDProhibitedBySupervision = 0xe8000083

For the latest error codes you can look at the pseudo-code of AMDErrorString.

MobileDeviceUpdater[edit source]

AMDS prompting to install a software update to connect to an iPhone X.

Since at least macOS High Sierra (possibly as early as the introduction of System Integrity Protection in OS X El Capitan), MobileDevice handles its own updates. When a device unknown to the currently installed build of MobileDevice is connected, prompts the user to install a software update. Previously, MobileDevice would only be updated by installing a full iTunes or Xcode update.

Due to System Integrity Protection, AMDS is installed to /Library/Apple/System/Library/PrivateFrameworks/MobileDevice.framework, which is symbolically linked to from /System/Library/PrivateFrameworks/MobileDevice.framework. Apps that use MobileDevice will use the new build upon next launch.

Additionally, extra bundles may be installed to /System/Library/CoreServices/CoreTypes.bundle/Contents/Library/CoreTypes-nnnn.bundle and /System/Library/CoreServices/CoreTypes.bundle/Contents/Library/MobileDevices-nnnn.bundle, registering icons for new devices unknown to the current base operating system. This includes Mac devices.