Some official/compatible AirTags don't work

[thisiscam]

Recently the 5 bytes matching trick discussed in #46 appears to stop working.
I also just tried #50 and seems like I can't find devices that are in nearby state using the example device_scanner.py

[malmeloo]

Hmm that's strange, I recently used the scanner for another project of mine and could've sworn it received multiple "nearby" reports. That said, I have received a report from someone else saying that the accessory key generation is not working properly, which might be related to your problem. I've been quite busy but will investigate a bit more soon, will keep you posted.

[thisiscam]

Hmm that's strange, I recently used the scanner for another project of mine and could've sworn it received multiple "nearby" reports. That said, I have received a report from someone else saying that the accessory key generation is not working properly, which might be related to your problem. I've been quite busy but will investigate a bit more soon, will keep you posted.

To clarify, I can see there are nearby devices, but I can't match them with my own devices with known private keys.

[malmeloo]

Ahh alright, thanks for the clarification. I'll look into it!

[malmeloo]

Could you try whether #91 fixes your issue? You can install it as a drop-in replacement using pip install -U git+https://github.com/malmeloo/FindMy.py@fix/nearby-device-discovery.

[thisiscam]

Could you try whether #91 fixes your issue? You can install it as a drop-in replacement using pip install -U git+https://github.com/malmeloo/FindMy.py@fix/nearby-device-discovery.

Unfortunately that didn't fix the problem. I was already doing a timeshift adjustment in my own code. Is it possible that Apple changed their "5 matching bytes" protocol?

[thisiscam]

Some possibilities:

1. The rotating key algorithm was changed
2. The 5 matching bytes protocol was changed
3. I'm not using the correct decrypted plist??

Reason 3) is possible is that one of my Mac was updated to macOS 15 recently and I can no longer decrypt the plist on that machine. Ref: MartinPham/FindMySync#38
So I ended up using an older mac that's still on macOS 13 to decrypt the plist on that machine. Interestingly, I found this new decrypted plist file to use the same private key as the one I had been using before, prior to the macOS15 update. So maybe this explains away the possibility of 3) a little bit, but I'm not sure if there are catches.

[malmeloo]

That's really strange, and I'm honestly not sure what's going wrong. Of course it's possible that Apple changed the spec, but that's assuming that they somehow have the ability to update both airtags and 3rd party tags over the air.

I'm picking up my own 3rd party tag soon to do some experiments on this.

[thisiscam]

I'm leaning towards 1) at the moment. If I put my phone on flight mode, I get one (new) separated device, which presumably is my airtag. But it also doesn't match with any known public key in the time shift range.

[thisiscam]

Ok this should eliminate possibility of 2):

I put my phone flight mode, got one separated device:

SEPARATED Device - DC:B0:6B:C1:E1:20
  Public key:   XLBrweEg0MRQwAt5gk0zk0rRDOQtdW2vr1WCqw==
  Lookup key:   IcctnBNQnY0H3Pqq7JQzGtIQxDNvFAs2yWb2TlH3lkw=
  Status byte:  0
  Hint byte:    0
  Extra data:

I checked that

>>> import base64
>>> s = "XLBrweEg0MRQwAt5gk0zk0rRDOQtdW2vr1WCqw=="
>>> base64.b64decode(s)[1:6].hex()
'b06bc1e120'

So it seems like the 5 bytes trick is still valid!

It then seems likely that they changed the rotating key algorithm. They could be changing only the official airtag's algorithm afaik. I can see an airtag software version number on my phone --- not sure if recently got updated though!

[malmeloo]

The public key generated by the library is partially derived from those bytes in the mac address, so I'm not surprised it checks out ;-). And that's interesting, though I guess it makes sense that Apple would want to update the firmware on their own tags. Theoretically speaking it would be possible for Apple to use a new, updated algorithm only on their devices / AirTags, since owner devices are aware of the type of accessory that they're tracking.

If possible, could you try to re-pair the tag, then dump the plist again and see if that fixes the issue, at least temporarily?

[thisiscam]

The public key generated by the library is partially derived from those bytes in the mac address, so I'm not surprised it checks out ;-). And that's interesting, though I guess it makes sense that Apple would want to update the firmware on their own tags. Theoretically speaking it would be possible for Apple to use a new, updated algorithm only on their devices / AirTags, since owner devices are aware of the type of accessory that they're tracking.

If possible, could you try to re-pair the tag, then dump the plist again and see if that fixes the issue, at least temporarily?

Yeah, I re-paired, dumped and decoded the plist on macOS 13. The plist correctly reflects that I have repaired. But that did not fix the issue.

[malmeloo]

That unfortunate; I'll probably pick up a tag next week and experiment a bit on my own. Will let you know how it goes.

[thisiscam]

Sorry for the ping --- is there an update to this? Should I an opensource tag instead?