ErrorCode 1: Error copying keychain data (MBErrorDomain/1) about libimobiledevice

[airwolf2026]

In ios7 when device lockwithpasscode, idevicebackup2 get the error:

Error saving snapshot properties (MBErrorDomain/102). Underlying error: The operation couldn’t be completed. (Cocoa error 513.) at path "/var/root/Library/Caches/Backup/B7B313CC-DEB5-42C7-AF3B-FF0F3326739B/Manifest.plist" (NSCocoaErrorDomain/513). Underlying error: The operation couldn’t be completed. Operation not permitted (NSPOSIXErrorDomain/1)..

[airwolf2026]

from the device log, maybe itunes start the com.apple.mobilebackup2 service with some keybag,so itunes could backup without unlock the device

Aug 28 15:58:56 Administrators-iPhone lockdownd[52] : 00241000 unlock_with_escrow: Starting service with bag=8951e1d5a6b9f31e6bcc87104f580991c43f73a7
Aug 28 15:58:57 Administrators-iPhone lockdownd[52] : FAILURE: Failed to open property list at file:///private/var/db/launchd.db/com.apple.launchd/overrides.plist for reading. (The operation couldnt be completed. No such file or directory)
Aug 28 15:58:57 Administrators-iPhone UserEventAgent[14] : LockStateNotifier aksNotificationCallback posting notification: com.apple.mobile.keybagd.lock_status
Aug 28 15:58:57 Administrators-iPhone profiled[671] : (Note ) profiled: Service starting...
Aug 28 15:58:57 Administrators-iPhone kernel[0] : AppleKeyStore:Sending lock change 0
Aug 28 15:58:57 Administrators-iPhone BackupAgent2[672] : 00283000 unlock_with_escrow: Starting service with bag=8951e1d5a6b9f31e6bcc87104f580991c43f73a7

[FunkyM]

We need to send the EscrowBag in one of the backup requests in order for this to work.
Only the recent iOS 7 changes in the "trustdialog" branch are able to do that.

[nikias]

Since the trustdialog branch has been merged to master already this should work now.

[FunkyM]

@nikias Are you sure? I don't see that idevicebackup2 passes the EscrowBag in the requests to the device yet so I think this can't yet work.

[mingio]

Actually it seems it can't work yet.

------------------ 原始邮件 ------------------
发件人: "Martin Szulecki";[email protected];
发送时间: 2014年2月5日(星期三) 晚上6:09
收件人: "libimobiledevice/libimobiledevice"[email protected];
抄送: "steven"[email protected];
主题: Re: [libimobiledevice] ErrorCode 1: Error copying keychain data(MBErrorDomain/1) (#12)

@nikias Are you sure? I don't see that idevicebackup2 passes the EscrowBag in the requests to the device yet so I think this can't yet work.

—
Reply to this email directly or view it on GitHub.

[nikias]

@FunkyM I misinterpreted your comment "Only the recent iOS 7 changes in the "trustdialog" branch are able to do that." as "it's available in trustdialog branch". Sorry.

[MCE-KobyBo]

When starting the mobilebackup2 service, the EscrowBag should be sent with the StartService request. I saw an older patch which did it for every service, but was removed because it broke other services. I tried it and it does seem to break other services (I tried AFC).
While looking into it, I found a project called SDMMobileDevice (https://github.com/samdmarshall/SDMMobileDevice), which is based on reverse engineering Apple's framework. If you'll look at its "start service" function (SDMMD_send_service_start in SDMMD_Connection.c), there's an option indicating whether the EscrowBag should be sent. So it seems that in Apple's framework, its up to caller of "start service" to decide if the escrow bag should be sent.
I think we should do same, and provide a lockdownd_start_service variant which allows the use of the escrow bag (that what I'm currently doing in my fork, at least as a temp solution). What do you think?

[nikias]

I think it would probably be the best choice to provide a new function lockdownd_start_service_with_escrow_bag

[FunkyM]

+1 from me. Sounds like the "natural thing" to add.
Is it enough to just use it idevicebackup2?
Perhaps lockdownd_start_service_with_options() might be a way to also include the other options.

[nikias]

I don't know of any other service that would use it, but with that function we would be flexible :)

[MCE-KobyBo]

I like the lockdownd_start_service_with_options, as it will be easy to extend.
I'm currently implementing it, I'll send a pull request later today.

[FunkyM]

Looks like there are no other options besides the EscrowBag. Thus, we came down to either implement lockdownd_start_service_with_escrow_bag() or extend lockdownd_start_service() with a new parameter (optionally NULL) to pass the "bag". We'd like to prevent injection of arbitrary plist dictionaries using arguments in favor of clear arguments.

[MCE-KobyBo]

After looking at the other options, it seems that the rest of the options in Apple's framework are related to the connection itself (like timeouts), which which might be useful in the future. If you don't like to use plists, I think lockdownd_start_service_with_escrow_bag will be a better choice for backward compatibility with existing code.
I implemented lockdownd_start_service_with_options, modified idevicebackup2 to use it, and successfully tested it on a passcode locked iPhone 5S. I can easily modify it to lockdownd_start_service_with_escrow_bag and send a pull request if you like.

[nikias]

Timeout and connection related stuff does not belong into lockdownd, that - if really required - 'would belong into idevice_connection* stuff. So we stick with the lockdownd_start_service_with_escrow_bag.

[FunkyM]

Fixed in git master.