{
  "added_at": "2026-11-02",
  "additional_evidence_urls": [
    "https://github.com/seemoo-lab/apple-continuity-tools/blob/b93207b5887c6bef8c9e0e16a442149fb3520e28/LICENSE",
    "https://github.com/seemoo-lab/apple-continuity-tools/blob/b93207b5887c6bef8c9e0e16a442149fb3520e28/Makefile",
    "https://github.com/seemoo-lab/apple-continuity-tools/blob/b93207b5887c6bef8c9e0e16a442149fb3520e28/requirements.txt",
    "https://github.com/seemoo-lab/apple-continuity-tools/blob/b93207b5887c6bef8c9e0e16a442149fb3520e28/process_recon/README.md",
    "https://github.com/seemoo-lab/apple-continuity-tools/blob/b93207b5887c6bef8c9e0e16a442149fb3520e28/keychain_access/README.md",
    "https://github.com/seemoo-lab/apple-continuity-tools/blob/b93207b5887c6bef8c9e0e16a442149fb3520e28/keychain_access/keychain_access.py",
    "https://github.com/seemoo-lab/apple-continuity-tools/blob/b93207b5887c6bef8c9e0e16a442149fb3520e28/keychain_access/tests/test.sh",
    "https://github.com/seemoo-lab/apple-continuity-tools/blob/b93207b5887c6bef8c9e0e16a442149fb3520e28/continuity_messages/README.md",
    "https://github.com/seemoo-lab/apple-continuity-tools/blob/b93207b5887c6bef8c9e0e16a442149fb3520e28/continuity_messages/packet_breakpoints.txt",
    "https://github.com/seemoo-lab/apple-continuity-tools/commit/b93207b5887c6bef8c9e0e16a442149fb3520e28",
    "https://www.usenix.org/conference/usenixsecurity21/presentation/stute"
  ],
  "category": "protocol-analysis",
  "description_en": "Three macOS helpers from SEEMOO Lab that the Open Wireless Link project used to study Apple wireless services such as AirDrop, Wi-Fi Password Sharing, Handoff and Offline Finding from the host side. process_recon summarizes which processes, log categories and subsystems emit log entries matching chosen keywords; keychain_access uses Frida to hook SecItemCopyMatching in a process and exports the keychain items it accesses to JSON; and lldb breakpoint commands print the Handoff and Universal Clipboard messages that the rapportd daemon sends and receives.",
  "description_zh": "SEEMOO 实验室的三个 macOS 辅助工具，Open Wireless Link 项目曾用它们从主机一侧研究 AirDrop、Wi-Fi 密码共享、Handoff 和离线查找等 Apple 无线服务。process_recon 汇总哪些进程、日志类别和子系统产生了含指定关键词的日志；keychain_access 借助 Frida 挂接某一进程中的 SecItemCopyMatching，把该进程访问的钥匙串条目导出为 JSON；另有一组 lldb 断点命令，可打印 rapportd 守护进程收发的 Handoff 与通用剪贴板消息。",
  "entry_url": "https://awesomerea.org/resources/apple-continuity-tools/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/apple-continuity-tools/",
  "evidence_url": "https://github.com/seemoo-lab/apple-continuity-tools/blob/b93207b5887c6bef8c9e0e16a442149fb3520e28/README.md",
  "group": "tools",
  "id": "apple-continuity-tools",
  "json_url": "https://awesomerea.org/resources/apple-continuity-tools/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/apple-continuity-tools/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/apple-continuity-tools/index.md",
  "name": "Apple Continuity Reverse Engineering Toolkit",
  "name_zh": "Apple Continuity 逆向工程工具包",
  "record_type": "resource",
  "relationship": "foundation",
  "requirements": [
    "The repository has three commits: the initial release and a paper link on 2021-04-12, and a 2026-08-17 README edit that replaces the former Open Wireless Link website link with a note that the site is no longer associated with the project. There are no releases. The process_recon example was recorded on macOS 11.0 and the breakpoints name private Rapport framework methods; support for current macOS releases is not documented.",
    "Runs on the analyst's own Mac with Python 3 in a virtual environment and Node.js; make install installs the pinned requirements, including frida 14.2.7 and frida-tools 9.1.0 from 2021, plus the prettier dev dependency. continuity_messages needs lldb and SIP's debugging protection turned off, and keychain_access needs SIP fully disabled for system processes; the README warns about the security implications.",
    "Inputs are the analyst's own devices and accounts: the rapportd examples involve an iPhone next to the Mac and keys for the analyst's iCloud devices, so keychain_access output holds real secrets and should be handled accordingly. keychain_access/tests has small Swift and Objective-C hackme programs and a test.sh that stores and then extracts a dummy keychain password; there are no other tests.",
    "The tools watch logs, keychain calls and daemon messages on the host; they do not capture or decode over-the-air Bluetooth LE or AWDL traffic, unlike the separately listed furiousMAC Continuity notes and Wireshark dissector for Continuity advertisements. The README lists the authors' USENIX Security 2021 Continuity and 2019 AWDL papers and a 2020 dissertation as related publications.",
    "GPL-3.0."
  ],
  "requirements_zh": [
    "仓库只有三个提交：2021-04-12 的初始发布与论文链接，以及 2026-08-17 对 README 的修改，把原 Open Wireless Link 网站链接换成说明该网站已与项目无关的提示。没有发布版本。process_recon 的示例记录于 macOS 11.0，断点针对的是私有 Rapport 框架的方法；未说明是否支持当前 macOS 版本。",
    "在分析者自己的 Mac 上运行，需要虚拟环境中的 Python 3 和 Node.js；make install 会安装锁定版本的依赖，包括 2021 年的 frida 14.2.7 和 frida-tools 9.1.0，以及开发依赖 prettier。continuity_messages 需要 lldb，并需关闭 SIP 的调试保护；keychain_access 用于系统进程时需完全关闭 SIP；README 提醒注意其安全影响。",
    "输入来自分析者自己的设备和账号：rapportd 示例涉及放在 Mac 旁的 iPhone 以及分析者 iCloud 设备的密钥，因此 keychain_access 的输出包含真实机密，应妥善处理。keychain_access/tests 中有小型 Swift 和 Objective-C hackme 程序，以及先存入再提取一个虚拟钥匙串密码的 test.sh；除此之外没有测试。",
    "这些工具观察的是主机上的日志、钥匙串调用和守护进程消息，并不捕获或解码空中的蓝牙低功耗或 AWDL 流量；这一点不同于另行收录、针对 Continuity 广播的 furiousMAC Continuity 笔记与 Wireshark 解析器。README 将作者的 USENIX Security 2021 Continuity 论文、2019 年 AWDL 论文和一篇 2020 年博士论文列为相关出版物。",
    "采用 GPL-3.0。"
  ],
  "targets": [
    "protocol"
  ],
  "url": "https://github.com/seemoo-lab/apple-continuity-tools",
  "verification": "source-reviewed",
  "verified_at": "2026-10-20"
}