retroplasma/flyover-reverse-engineering
Reversing Apple’s 3D satellite mode
repo name | retroplasma/flyover-reverse-engineering |
repo link | https://github.com/retroplasma/flyover-reverse-engineering |
homepage | |
language | Go |
size (curr.) | 126 kB |
stars (curr.) | 448 |
created | 2019-02-02 |
license | |
This is an attempt to reverse-engineer Flyover (= 3D satellite mode) from Apple Maps. Main goal is to document the results and to provide code that emerges.
Status
We can authenticate URLs and retrieve textured 3D models from given coordinates (latitude, longitude). Limitation: Slow lookup for regions with tall models such as skyscrapers, which is because not all metadata has been reverse-engineered yet; see status board for details.
General
Data is stored in map tiles. These five tile styles are used for Flyover:
Type | Purpose | URL structure |
---|---|---|
C3M | Texture, Mesh, Transformation(, Animation) | 🅐(?|&)style=15&v=⓿®ion=❶&x=❷&y=❸&z=❹&h=❺ |
C3MM 1 | Metadata | 🅐(?|&)style=14&v=⓿&part=❻®ion=❶ |
C3MM 2 | Metadata | 🅐(?|&)style=52&v=⓿®ion=❶&x=❷&y=❸&z=❹&h=❺ |
DTM 1 | Terrain/Surface/Elevation | 🅐(?|&)style=16&v=⓿®ion=❶&x=❷&y=❸&z=❹ |
DTM 2 | Terrain/Surface/Elevation | 🅐(?|&)style=17&v=⓿&size=❼&scale=❽&x=❷&y=❸&z=❹ |
- 🅐: URL prefix from resource manifest
- ⓿: Version from resource manifest or altitude manifest using region
- ❶: Region ID from altitude manifest
- ❷❸❹: Map tile numbers (tiled web map scheme)
- ❺: Height/altitude index. Probably from C3MM
- ❻: Incremental part number
- ❼❽: Size/scale. Not sure where its values come from
Resource hierarchy
ResourceManifest
└─ AltitudeManifest
├─ C3MM
│ └─ C3M
└─ DTM?
Focusing on C3M(M) for now. DTMs are just images with a footer; they’re probably used for the grid that is displayed when Maps is loading.
Code
This repository is structured as follows:
Directory | Description |
---|---|
cmd | command line programs |
pkg | most of the actual code |
proto | protobuf files |
scripts | additional scripts |
vendor | dependencies |
Install
Install Go and run go get github.com/retroplasma/flyover-reverse-engineering
. Then edit config.json in $GOPATH/src/github.com/retroplasma/flyover-reverse-engineering
:
- automatically on macOS:
./scripts/get_config_macos.sh > config.json
- or manually:
resourceManifestURL
: from com.apple.GEO.plist or GeoServices binarytokenP1
: from GeoServices binary (function:GEOURLAuthenticationGenerateURL
)
Command line programs
Here are some independent command line programs that use code from pkg:
Export OBJ (proof of concept, slow)
Usage:
go run cmd/poc-export-obj/main.go [lat] [lon] [zoom] [tryXY] [tryH]
Parameter Description Example
--------------------------------------
lat Latitude 34.007603
lon Longitude -118.499741
zoom Zoom (~ 13-20) 20
tryXY Horizontal scan 3
tryH Vertical scan 2
This exports Santa Monica Pier to ./downloaded_files/obj/...
:
go run cmd/poc-export-obj/main.go 34.007603 -118.499741 20 3 2
Optional: Center-scale OBJ using node.js script:
node scripts/center_scale_obj.js
In Blender (compatible tutorial here):
Authenticate URLs
This authenticates a URL using parameters from config.json
:
go run cmd/auth/main.go [url]
Parse C3M file
This parses a C3M v3 file, decompresses meshes, reads JPEG textures and produces a struct that contains a textured 3d model:
go run cmd/parse-c3m/main.go [file]
Parse C3MM file (work in progress)
go run cmd/parse-c3mm/main.go [file]
Files on macOS
~/Library/Preferences/com.apple.GEO.plist
- last resource manifest url
~/Library/Caches/GeoServices/Resources/altitude-*.xml
- defines regions for c3m urls
altitude-*.xml
url in resource manifest
~/Library/Containers/com.apple.geod/Data/Library/Caches/com.apple.geod/MapTiles/MapTiles.sqlitedb
- local map tile cache
/System/Library/PrivateFrameworks/GeoServices.framework/GeoServices
- resource manifest base url, networking, caching, authentication
/System/Library/PrivateFrameworks/VectorKit.framework/VectorKit
- parsers, decoders
/System/Library/PrivateFrameworks/GeoServices.framework/XPCServices/com.apple.geod.xpc
- loads
GeoServices
- loads
/Applications/Maps.app/Contents/MacOS/Maps
- loads
VectorKit
- loads
Important
THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.