IOS location messages decode tool improves privacy analysis reliability
Decoding What iOS Location Services Send to Apple: An LLM Is an Unreliable Analyst but a Useful Toolmaker
Networking and Internet ArchitectureArtificial Intelligence
Summary
Figuring out the hidden details of location data sent by iPhones to Apple is usually a slow, tricky job that experts do. The authors tested if artificial intelligence can help with this task but found the AI often makes mistakes when trying to understand the data directly. However, AI can write tools to decode these messages correctly when the results can be double-checked. Using AI, they built a Python program that reliably extracts and reads these hidden data formats from iPhone software, helping to analyze iPhone location data more accurately.
What this means in practice
- •For mobile security analysts: Analyze iPhone location network data accurately by extracting protobuf schemas from Apple binaries using the AI-generated tool.
- •For privacy auditors: Use decoded location service messages to assess the data iOS devices send to Apple for privacy examination.
Authors
Douglas Leith
Abstract
Reverse engineering the data formats used by mobile software is skilled and slow, and using AI to assist with it is attractive. We evaluate this for the protobuf messages that an iPhone sends to Apple's location services. Working from Apple's binaries, we use two frontier models (Claude Opus 4.8, Codex GPT Sol 5.6) to reconstruct the schemas of protobufs observed in network traffic. The great majority of the schemas contain substantial errors, and these are hard to detect because the schemas are internally consistent. Direct AI use is therefore unsuitable for forensic and privacy analysis. AI can, however, write reliable analysis tools when their output can be validated. We use Claude to write a Python tool, Extractor, that reliably recovers protobuf schemas from Apple binaries. We validate it against binaries compiled from schemas with known answers, previously published schemas, and network measurements. We demonstrate the use of Extractor to decode and analyse the location services network traffic of a jailbroken iPhone 8 (iOS 16.7.11).