Skip to content

Instantly share code, notes, and snippets.

@marcnewlin

marcnewlin/apple-hid-read-flash.py

Created March 23, 2024 15:47
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save marcnewlin/bbdecb8c01746f267cdd187ff6ce36c1 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save marcnewlin/bbdecb8c01746f267cdd187ff6ce36c1 to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. marcnewlin renamed this gist Mar 23, 2024. 1 changed file with 0 additions and 0 deletions.
    0 gistfile1.txt → apple-hid-read-flash.py
    View file
    File renamed without changes.
  2. marcnewlin created this gist Mar 23, 2024.
    41 changes: 41 additions & 0 deletions gistfile1.txt
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,41 @@
    #!/usr/bin/env python3

    import usb.core
    import struct
    from collections import namedtuple

    APPLE_VID = 0x05ac

    Target = namedtuple("Target", ["vid", "pid", "name", "model", "total_size"])

    targets = [
    Target(APPLE_VID, 0x0269, "Magic Mouse", "A1657", 524288),
    Target(APPLE_VID, 0x026c, "Magic Keyboard with Numeric Keypad", "A1843", 524288),
    Target(APPLE_VID, 0x029a, "Magic Keyboard with Touch ID", "A2449", 2097152),
    Target(APPLE_VID, 0x029c, "Magic Keyboard", "A2450", 524288),
    Target(APPLE_VID, 0x029f, "Magic Keyboard with Touch ID and Numeric Keypad", "A2520", 2097152),
    Target(APPLE_VID, 0x0315, "Apple TV Remote", "A2854", 1015800),
    ]

    dev = usb.core.find(idVendor=APPLE_VID)
    if dev is not None:

    for x in range(5):
    if dev.is_kernel_driver_active(x):
    dev.detach_kernel_driver(x)

    for t in targets:
    if dev.idProduct == t.pid:
    with open("%s.bin" % t.model, "wb") as f:
    offset = 0
    chunk_size = 256
    while offset < t.total_size:
    dev.ctrl_transfer(0x21, 0x09, 0x03B6, 0, b"\xB6" + struct.pack(">I", offset)[1:])
    res = bytes(dev.ctrl_transfer(0xa1, 0x01, 0x03B6, 0, chunk_size))
    offset += (len(res) - 4)
    f.write(res[4:])
    print(bytearray(res).hex())
    print("created %s.bin" % t.model)
    quit()

    print("no supported device found")