Prepare Restore Session: the first absurd Lock
Listing snapshots was not the hard problem. The hard problem started the moment you try to do what the phone does in Settings—prepare a restore / download session. On the CloudKit side that means earning a Lock on a zone record before the file catalog and MMCS path open up. On 29 April 2026 that wall became impossible to ignore.
What iOS shows as “preparing” is, on the wire, a tightly ordered CloudKit dance inside
com.apple.backup.ios / zone mbksync. In today’s extractor the
bootstrap still follows the same spine we were chasing then:
zones (FetchRecordZones) →
BackupAccount →
device record D:<sha> →
snapshot batch S: (and optional Mobile Backup stub) →
then record/save Lock →
only after that the big post-Lock N: file-list retrieves.
The Lock itself is a CKDModifyRecordsOperation-Private that writes a record
named {deviceSha}:Lock (type Lock) into
mbksync, with an owner tied to that device SHA and a duration on the order of
days. Fail the identity that MobileBackupServerExtension expects and you get the cold
rejection we learned by heart: Invalid lock id.
That is where the “hardware private signatures” showed up. The restore session carries a Foreground Restore plist—stable hw/sha material that must match what the backup domain believes about the restoring host. Invent it casually and Lock dies. Even protobuf packaging mattered later: a double-wrapped field name produced the wrong Lock shape and the same invalid-id failure. Snapshot list success had fooled me into thinking the mountain was climbed; Lock proved we were still in the foothills.
Help came from an ugly coalition. Frida on the
jailbroken iPhone let us watch and influence the live AuthKit / backupd
world that actually knows how to speak Foreground. Beside that, a few
malformed Elcomsoft request/response pairs—broken enough to be wrong for a
clean download, useful enough as fossils—hinted at which records and which order the gateway
insisted on. Reconstructing a coherent Prepare Restore Session from those crumbs was the
extraordinary part: not a single clever packet, but a state machine that only makes sense
once Lock, Foreground, and the D:/S: catalog agree.
After Lock, the road continues into keybags, PCS, and MMCS. On 29 April the victory condition
was simpler and more bitter: survive Prepare Restore without Invalid lock id,
or admit that listing snapshots had never been the real exam.