Reverse engineering proprietary network protocols means dealing with information scattered across log files, kernel traces, and network captures, often generated across multiple devices. Correlating events in these sources has been cumbersome and manual work, although their dependencies often make protocol analysis more conclusive.
This talk presents the reverse engineering process of Low-Latency WiFi (LLW), Apple’s proprietary link-layer protocol for real-time applications such as Sidecar Display and Continuity Camera, which has remained undocumented in prior reverse engineering of Apple’s ecosystem. We walk through how correlating kernel traces, network captures, and system logs across iOS and macOS devices helped reveal LLW’s internals. We publish logfuse, an open-source toolkit that made LLW’s internals accessible by aggregating heterogeneous traces from iOS and macOS into a single clock-aligned timeline.
View the slides here. Recording will follow soon.