I'm fooling around with Wireshark to capture the activation packets for an iPhone and some other stuff, however the traffic is encrypted. There should be a private SSL key somewhere on my computer to decrypt this traffic, but I've spent hours trying to find it with no luck. I'm on OSX Mavericks, latest iTunes build. I'd be very grateful if someone could help out.
Cracking that tunnel is a non-trivial exercise. The short answer is that key store is located in the file
/private/var/keybags/systembag.kb and retrieved with the kernel service called
AppleEffaceableStorage under the locker tag
\BAG1. This is the architecture:
The keys themselves are further encrypted and checksummed using AES and HMAC. It would be a big project for you to decrypt the stream. You would be much better off finding the memory buffer where the kernel process is storing the decrypted stream and just monitoring the buffer. I think the critical process is called
keybagd (keybag daemon). There is also a kernel extension called
AppleKeyStore which has a subcomponent called
MobileKeyBag. One or all of those processes will own a buffer containing the clear text traffic.