Add support for iOS 17+ Personalized Developer Disk image mounting

7 files changed, 792 insertions, 74 deletions

diff --git a/configure.ac b/configure.ac
index f1b9c76..c67e896 100644
--- a/configure.ac
+++ b/configure.ac
@@ -28,6 +28,7 @@ dnl Minimum package versions
 LIBUSBMUXD_VERSION=2.0.2
 LIBPLIST_VERSION=2.3.0
 LIMD_GLUE_VERSION=1.3.0
+LIBTATSU_VERSION=1.0.3
 
 AC_SUBST(LIBUSBMUXD_VERSION)
 AC_SUBST(LIBPLIST_VERSION)
@@ -43,6 +44,7 @@ LT_INIT
 PKG_CHECK_MODULES(libusbmuxd, libusbmuxd-2.0 >= $LIBUSBMUXD_VERSION)
 PKG_CHECK_MODULES(libplist, libplist-2.0 >= $LIBPLIST_VERSION)
 PKG_CHECK_MODULES(limd_glue, libimobiledevice-glue-1.0 >= $LIMD_GLUE_VERSION)
+PKG_CHECK_MODULES(libtatsu, libtatsu-1.0 >= $LIBTATSU_VERSION)
 AC_ARG_WITH([readline],
             [AS_HELP_STRING([--without-readline],
             [build without support for libreadline (default is yes)])],
diff --git a/cython/mobile_image_mounter.pxi b/cython/mobile_image_mounter.pxi
index a23a59b..d9d40d5 100644
--- a/cython/mobile_image_mounter.pxi
+++ b/cython/mobile_image_mounter.pxi
@@ -13,7 +13,9 @@ cdef extern from "libimobiledevice/mobile_image_mounter.h":
     mobile_image_mounter_error_t mobile_image_mounter_new(idevice_t device, lockdownd_service_descriptor_t descriptor, mobile_image_mounter_client_t *client)
     mobile_image_mounter_error_t mobile_image_mounter_free(mobile_image_mounter_client_t client)
     mobile_image_mounter_error_t mobile_image_mounter_lookup_image(mobile_image_mounter_client_t client, char *image_type, plist.plist_t *result)
-    mobile_image_mounter_error_t mobile_image_mounter_mount_image(mobile_image_mounter_client_t client, char *image_path, char *image_signature, uint16_t signature_length, char *image_type, plist.plist_t *result)
+    mobile_image_mounter_error_t mobile_image_mounter_mount_image_with_options(mobile_image_mounter_client_t client, char *image_path, const unsigned char *signature, unsigned int signature_length, char *image_type, plist.plist_t options, plist.plist_t *result)
+    mobile_image_mounter_error_t mobile_image_mounter_mount_image(mobile_image_mounter_client_t client, char *image_path, const unsigned char *signature, unsigned int signature_length, char *image_type, plist.plist_t *result)
+    mobile_image_mounter_error_t mobile_image_mounter_unmount_image(mobile_image_mounter_client_t client, const char *mount_path);
     mobile_image_mounter_error_t mobile_image_mounter_hangup(mobile_image_mounter_client_t client)
 
 cdef class MobileImageMounterError(BaseError):
@@ -57,11 +59,39 @@ cdef class MobileImageMounterClient(PropertyListService):
             if c_node != NULL:
                 plist.plist_free(c_node)
 
-    cpdef plist.Node mount_image(self, bytes image_path, bytes image_signature, bytes image_type):
+    cpdef plist.Node mount_image_with_options(self, bytes image_path, bytes signature, bytes image_type, object options):
         cdef:
+            plist.Node n_options
+            plist.plist_t c_options
+            plist.plist_t c_result = NULL
+            bint free_options = False
             plist.plist_t c_node = NULL
             mobile_image_mounter_error_t err
-        err = mobile_image_mounter_mount_image(self._c_client, image_path, image_signature, len(image_signature),
+        if isinstance(options, plist.Dict):
+            n_options = options
+            c_options = n_options._c_node
+        elif isinstance(options, dict):
+            c_options = plist.native_to_plist_t(options)
+            free_options = True
+        else:
+            raise InstallationProxyError(INSTPROXY_E_INVALID_ARG)
+        err = mobile_image_mounter_mount_image_with_options(self._c_client, image_path, signature, len(signature),
+                                               image_type, c_options, &c_node)
+        if free_options:
+            plist.plist_free(c_options)
+        try:
+            self.handle_error(err)
+
+            return plist.plist_t_to_node(c_node)
+        except Exception, e:
+            if c_node != NULL:
+                plist.plist_free(c_node)
+
+    cpdef plist.Node mount_image(self, bytes image_path, bytes signature, bytes image_type):
+        cdef:
+            plist.plist_t c_node = NULL
+            mobile_image_mounter_error_t err
+        err = mobile_image_mounter_mount_image(self._c_client, image_path, signature, len(signature),
                                                image_type, &c_node)
 
         try:
@@ -72,6 +102,13 @@ cdef class MobileImageMounterClient(PropertyListService):
             if c_node != NULL:
                 plist.plist_free(c_node)
 
+    cpdef unmount_image(self, bytes mount_path):
+        cdef:
+            mobile_image_mounter_error_t err
+        err = mobile_image_mounter_unmount_image(self._c_client, mount_path)
+
+        self.handle_error(err)
+
     cpdef hangup(self):
         cdef mobile_image_mounter_error_t err
         err = mobile_image_mounter_hangup(self._c_client)
diff --git a/docs/ideviceimagemounter.1 b/docs/ideviceimagemounter.1
index 832850a..1fe7e45 100644
--- a/docs/ideviceimagemounter.1
+++ b/docs/ideviceimagemounter.1
@@ -1,13 +1,32 @@
 .TH "ideviceimagemounter" 1
 .SH NAME
-ideviceimagemounter \- Mount disk images on the device.
+ideviceimagemounter \- Mount, list, or unmount a disk image on the device.
 .SH SYNOPSIS
 .B ideviceimagemounter
-[OPTIONS] IMAGE_FILE IMAGE_SIGNATURE_FILE
+[OPTIONS] COMMAND [COMMAND OPTIONS]
 
 .SH DESCRIPTION
 
-Mounts the specified disk image on the device.
+Mount, list, or unmount a disk image on the device.
+
+.SH COMMANDS
+.TP
+.B mount PATH
+Mount the developer disk image at PATH.
+For iOS 17+, PATH is a directory containing a .dmg image, a BuildManifest.plist,
+and a Firmware sub-directory.
+
+For older versions PATH is a .dmg filename with a .dmg.signature file in the same directory, or with
+another parameter pointing to a file elsewhere.
+.TP
+.B list
+List mounted disk images.
+.TP
+.B unmount PATH
+Unmount the image mounted at PATH.
+.TP
+.B devmodestatus
+Query the developer mode status (iOS 16+)
 
 .SH OPTIONS
 .TP
@@ -20,9 +39,6 @@ connect to network device.
 .B \-d, \-\-debug
 enable communication debugging.
 .TP
-.B \-l, \-\-list
-list mount information
-.TP
 .B \-t, \-\-imagetype NAME
 the image type to use, default is 'Developer'
 .TP
@@ -34,12 +50,6 @@ prints usage information
 .TP
 .B \-v, \-\-version
 prints version information.
-.TP
-.B IMAGE_FILE
-the image filename to mount
-.TP
-.B IMAGE_SIGNATURE_FILE
-corresponding signature file for image filename
 
 .SH AUTHOR
 Nikias Bassen
diff --git a/include/libimobiledevice/mobile_image_mounter.h b/include/libimobiledevice/mobile_image_mounter.h
index d4fc3f4..76bb61a 100644
--- a/include/libimobiledevice/mobile_image_mounter.h
+++ b/include/libimobiledevice/mobile_image_mounter.h
@@ -42,6 +42,7 @@ typedef enum {
         MOBILE_IMAGE_MOUNTER_E_CONN_FAILED    = -3,
         MOBILE_IMAGE_MOUNTER_E_COMMAND_FAILED = -4,
         MOBILE_IMAGE_MOUNTER_E_DEVICE_LOCKED  = -5,
+        MOBILE_IMAGE_MOUNTER_E_NOT_SUPPORTED  = -6,
         MOBILE_IMAGE_MOUNTER_E_UNKNOWN_ERROR  = -256
 } mobile_image_mounter_error_t;
 
@@ -127,7 +128,7 @@ LIBIMOBILEDEVICE_API mobile_image_mounter_error_t mobile_image_mounter_lookup_im
  * @return MOBILE_IMAGE_MOUNTER_E_SUCCESS on succes, or a
  *    MOBILE_IMAGE_MOUNTER_E_* error code otherwise.
  */
-LIBIMOBILEDEVICE_API mobile_image_mounter_error_t mobile_image_mounter_upload_image(mobile_image_mounter_client_t client, const char *image_type, size_t image_size, const char *signature, uint16_t signature_size, mobile_image_mounter_upload_cb_t upload_cb, void* userdata);
+LIBIMOBILEDEVICE_API mobile_image_mounter_error_t mobile_image_mounter_upload_image(mobile_image_mounter_client_t client, const char *image_type, size_t image_size, const unsigned char *signature, unsigned int signature_size, mobile_image_mounter_upload_cb_t upload_cb, void* userdata);
 
 /**
  * Mounts an image on the device.
@@ -138,19 +139,50 @@ LIBIMOBILEDEVICE_API mobile_image_mounter_error_t mobile_image_mounter_upload_im
  * @param signature Pointer to a buffer holding the images' signature
  * @param signature_size Length of the signature image_signature points to
  * @param image_type Type of image to mount
+ * @param options A dictionary containing additional key/value pairs to add
  * @param result Pointer to a plist that will receive the result of the
  *    operation.
  *
  * @note This function may return MOBILE_IMAGE_MOUNTER_E_SUCCESS even if the
  *    operation has failed. Check the resulting plist for further information.
- *    Note that there is no unmounting function. The mount persists until the
- *    device is rebooted.
  *
  * @return MOBILE_IMAGE_MOUNTER_E_SUCCESS on success,
  *    MOBILE_IMAGE_MOUNTER_E_INVALID_ARG if on ore more parameters are
  *    invalid, or another error code otherwise.
  */
-LIBIMOBILEDEVICE_API mobile_image_mounter_error_t mobile_image_mounter_mount_image(mobile_image_mounter_client_t client, const char *image_path, const char *signature, uint16_t signature_size, const char *image_type, plist_t *result);
+LIBIMOBILEDEVICE_API mobile_image_mounter_error_t mobile_image_mounter_mount_image_with_options(mobile_image_mounter_client_t client, const char *image_path, const unsigned char *signature, unsigned int signature_size, const char *image_type, plist_t options, plist_t *result);
+
+/**
+ * Mounts an image on the device.
+ *
+ * @param client The connected mobile_image_mounter client.
+ * @param image_path The absolute path of the image to mount. The image must
+ *    be present before calling this function.
+ * @param signature Pointer to a buffer holding the images' signature
+ * @param signature_size Length of the signature image_signature points to
+ * @param image_type Type of image to mount
+ * @param result Pointer to a plist that will receive the result of the
+ *    operation.
+ *
+ * @note This function may return MOBILE_IMAGE_MOUNTER_E_SUCCESS even if the
+ *    operation has failed. Check the resulting plist for further information.
+ *
+ * @return MOBILE_IMAGE_MOUNTER_E_SUCCESS on success,
+ *    MOBILE_IMAGE_MOUNTER_E_INVALID_ARG if on ore more parameters are
+ *    invalid, or another error code otherwise.
+ */
+LIBIMOBILEDEVICE_API mobile_image_mounter_error_t mobile_image_mounter_mount_image(mobile_image_mounter_client_t client, const char *image_path, const unsigned char *signature, unsigned int signature_size, const char *image_type, plist_t *result);
+
+/**
+ * Unmount a mounted image at given path on the device.
+ *
+ * @param client The connected mobile_image_mounter client.
+ * @param mount_path The mount path of the mounted image on the device.
+ *
+ * @return MOBILE_IMAGE_MOUNTER_E_SUCCESS on success,
+ *    or a MOBILE_IMAGE_MOUNTER_E_* error code on error.
+ */
+LIBIMOBILEDEVICE_API mobile_image_mounter_error_t mobile_image_mounter_unmount_image(mobile_image_mounter_client_t client, const char *mount_path);
 
 /**
  * Hangs up the connection to the mobile_image_mounter service.
@@ -165,6 +197,77 @@ LIBIMOBILEDEVICE_API mobile_image_mounter_error_t mobile_image_mounter_mount_ima
  */
 LIBIMOBILEDEVICE_API mobile_image_mounter_error_t mobile_image_mounter_hangup(mobile_image_mounter_client_t client);
 
+/**
+ * Query the developer mode status of the given device.
+ *
+ * @param client The connected mobile_image_mounter client.
+ * @param result A pointer to a plist_t that will be set to the resulting developer mode status dictionary.
+ *
+ * @return MOBILE_IMAGE_MOUNTER_E_SUCCESS on success,
+ *    or a MOBILE_IMAGE_MOUNTER_E_* error code on error.
+ */
+LIBIMOBILEDEVICE_API mobile_image_mounter_error_t mobile_image_mounter_query_developer_mode_status(mobile_image_mounter_client_t client, plist_t *result);
+
+/**
+ * Query a personalization nonce for the given image type, used for personalized disk images (iOS 17+).
+ * This nonce is supposed to be added to the TSS request for the corresponding image.
+ *
+ * @param client The connected mobile_image_mounter client.
+ * @param image_type The image_type to get the personalization nonce for, usually `DeveloperDiskImage`.
+ * @param nonce Pointer that will be set to an allocated buffer with the nonce value.
+ * @param nonce_size Pointer to an unsigned int that will receive the size of the nonce value.
+ *
+ * @return MOBILE_IMAGE_MOUNTER_E_SUCCESS on success,
+ *    or a MOBILE_IMAGE_MOUNTER_E_* error code on error.
+ */
+LIBIMOBILEDEVICE_API mobile_image_mounter_error_t mobile_image_mounter_query_nonce(mobile_image_mounter_client_t client, const char* image_type, unsigned char** nonce, unsigned int* nonce_size);
+
+/**
+ * Query personalization identitifers for the given image_type.
+ *
+ * @param client The connected mobile_image_mounter client.
+ * @param image_type The image_type to get the personalization identifiers for. Can be NULL.
+ * @param result A pointer to a plist_t that will be set to the resulting identifier dictionary.
+ *
+ * @return MOBILE_IMAGE_MOUNTER_E_SUCCESS on success,
+ *    or a MOBILE_IMAGE_MOUNTER_E_* error code on error.
+ */
+LIBIMOBILEDEVICE_API mobile_image_mounter_error_t mobile_image_mounter_query_personalization_identifiers(mobile_image_mounter_client_t client, const char* image_type, plist_t *result);
+
+/**
+ *
+ * @param client The connected mobile_image_mounter client.
+ * @param image_type The image_type to get the personalization identifiers for. Can be NULL.
+ * @param signature The signature of the corresponding personalized image.
+ * @param signature_size The size of signature.
+ * @param manifest Pointer that will be set to an allocated buffer with the manifest data.
+ * @param manifest_size Pointer to an unsigned int that will be set to the size of the manifest data.
+ *
+ * @return MOBILE_IMAGE_MOUNTER_E_SUCCESS on success,
+ *    or a MOBILE_IMAGE_MOUNTER_E_* error code on error.
+ */
+LIBIMOBILEDEVICE_API mobile_image_mounter_error_t mobile_image_mounter_query_personalization_manifest(mobile_image_mounter_client_t client, const char* image_type, const unsigned char* signature, unsigned int signature_size, unsigned char** manifest, unsigned int* manifest_size);
+
+/**
+ * Roll the personalization nonce.
+ *
+ * @param client The connected mobile_image_mounter client.
+ *
+ * @return MOBILE_IMAGE_MOUNTER_E_SUCCESS on success,
+ *    or a MOBILE_IMAGE_MOUNTER_E_* error code on error.
+ */
+LIBIMOBILEDEVICE_API mobile_image_mounter_error_t mobile_image_mounter_roll_personalization_nonce(mobile_image_mounter_client_t client);
+
+/**
+ * Roll the Cryptex nonce.
+ *
+ * @param client The connected mobile_image_mounter client.
+ *
+ * @return MOBILE_IMAGE_MOUNTER_E_SUCCESS on success,
+ *    or a MOBILE_IMAGE_MOUNTER_E_* error code on error.
+ */
+LIBIMOBILEDEVICE_API mobile_image_mounter_error_t mobile_image_mounter_roll_cryptex_nonce(mobile_image_mounter_client_t client);
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/src/mobile_image_mounter.c b/src/mobile_image_mounter.c
index 5df8e86..6df50c4 100644
--- a/src/mobile_image_mounter.c
+++ b/src/mobile_image_mounter.c
@@ -181,7 +181,7 @@ static mobile_image_mounter_error_t process_result(plist_t result, const char *e
         return res;
 }
 
-mobile_image_mounter_error_t mobile_image_mounter_upload_image(mobile_image_mounter_client_t client, const char *image_type, size_t image_size, const char *signature, uint16_t signature_size, mobile_image_mounter_upload_cb_t upload_cb, void* userdata)
+mobile_image_mounter_error_t mobile_image_mounter_upload_image(mobile_image_mounter_client_t client, const char *image_type, size_t image_size, const unsigned char *signature, unsigned int signature_size, mobile_image_mounter_upload_cb_t upload_cb, void* userdata)
 {
         if (!client || !image_type || (image_size == 0) || !upload_cb) {
                 return MOBILE_IMAGE_MOUNTER_E_INVALID_ARG;
@@ -192,7 +192,7 @@ mobile_image_mounter_error_t mobile_image_mounter_upload_image(mobile_image_moun
         plist_t dict = plist_new_dict();
         plist_dict_set_item(dict, "Command", plist_new_string("ReceiveBytes"));
         if (signature && signature_size != 0)
-                plist_dict_set_item(dict, "ImageSignature", plist_new_data(signature, signature_size));
+                plist_dict_set_item(dict, "ImageSignature", plist_new_data((char*)signature, signature_size));
         plist_dict_set_item(dict, "ImageSize", plist_new_uint(image_size));
         plist_dict_set_item(dict, "ImageType", plist_new_string(image_type));
 
@@ -241,6 +241,7 @@ mobile_image_mounter_error_t mobile_image_mounter_upload_image(mobile_image_moun
         free(buf);
         if (tx < image_size) {
                 debug_info("Error: failed to upload image");
+                res = MOBILE_IMAGE_MOUNTER_E_COMMAND_FAILED;
                 goto leave_unlock;
         }
         debug_info("image uploaded");
@@ -260,7 +261,7 @@ leave_unlock:
 
 }
 
-mobile_image_mounter_error_t mobile_image_mounter_mount_image(mobile_image_mounter_client_t client, const char *image_path, const char *signature, uint16_t signature_size, const char *image_type, plist_t *result)
+mobile_image_mounter_error_t mobile_image_mounter_mount_image_with_options(mobile_image_mounter_client_t client, const char *image_path, const unsigned char *signature, unsigned int signature_size, const char *image_type, plist_t options, plist_t *result)
 {
         if (!client || !image_path || !image_type || !result) {
                 return MOBILE_IMAGE_MOUNTER_E_INVALID_ARG;
@@ -271,8 +272,11 @@ mobile_image_mounter_error_t mobile_image_mounter_mount_image(mobile_image_mount
         plist_dict_set_item(dict, "Command", plist_new_string("MountImage"));
         plist_dict_set_item(dict, "ImagePath", plist_new_string(image_path));
         if (signature && signature_size != 0)
-                plist_dict_set_item(dict, "ImageSignature", plist_new_data(signature, signature_size));
+                plist_dict_set_item(dict, "ImageSignature", plist_new_data((char*)signature, signature_size));
         plist_dict_set_item(dict, "ImageType", plist_new_string(image_type));
+        if (PLIST_IS_DICT(options)) {
+                plist_dict_merge(&dict, options);
+        }
 
         mobile_image_mounter_error_t res = mobile_image_mounter_error(property_list_service_send_xml_plist(client->parent, dict));
         plist_free(dict);
@@ -292,6 +296,56 @@ leave_unlock:
         return res;
 }
 
+mobile_image_mounter_error_t mobile_image_mounter_mount_image(mobile_image_mounter_client_t client, const char *image_path, const unsigned char *signature, unsigned int signature_size, const char *image_type, plist_t *result)
+{
+        return mobile_image_mounter_mount_image_with_options(client, image_path, signature, signature_size, image_type, NULL, result);
+}
+
+mobile_image_mounter_error_t mobile_image_mounter_unmount_image(mobile_image_mounter_client_t client, const char *mount_path)
+{
+        if (!client || !mount_path) {
+                return MOBILE_IMAGE_MOUNTER_E_INVALID_ARG;
+        }
+        mobile_image_mounter_lock(client);
+
+        plist_t dict = plist_new_dict();
+        plist_dict_set_item(dict, "Command", plist_new_string("UnmountImage"));
+        plist_dict_set_item(dict, "MountPath", plist_new_string(mount_path));
+        mobile_image_mounter_error_t res = mobile_image_mounter_error(property_list_service_send_xml_plist(client->parent, dict));
+        plist_free(dict);
+
+        if (res != MOBILE_IMAGE_MOUNTER_E_SUCCESS) {
+                debug_info("%s: Error sending XML plist to device!", __func__);
+                goto leave_unlock;
+        }
+
+        plist_t result = NULL;
+        res = mobile_image_mounter_error(property_list_service_receive_plist(client->parent, &result));
+        if (res != MOBILE_IMAGE_MOUNTER_E_SUCCESS) {
+                debug_info("%s: Error receiving response from device!", __func__);
+        } else {
+                plist_t p_error = plist_dict_get_item(result, "Error");
+                if (p_error) {
+                        plist_t p_detailed = plist_dict_get_item(result, "DetailedError");
+                        const char* detailederr = (p_detailed) ? plist_get_string_ptr(p_detailed, NULL) : "";
+                        const char* errstr = plist_get_string_ptr(p_error, NULL);
+                        if (errstr && !strcmp(errstr, "UnknownCommand")) {
+                                res = MOBILE_IMAGE_MOUNTER_E_NOT_SUPPORTED;
+                        } else if (errstr && !strcmp(errstr, "DeviceLocked")) {
+                                res = MOBILE_IMAGE_MOUNTER_E_DEVICE_LOCKED;
+                        } else if (strstr(detailederr, "no matching entry")) {
+                                res = MOBILE_IMAGE_MOUNTER_E_COMMAND_FAILED;
+                        } else {
+                                res = MOBILE_IMAGE_MOUNTER_E_UNKNOWN_ERROR;
+                        }
+                }
+        }
+
+leave_unlock:
+        mobile_image_mounter_unlock(client);
+        return res;
+}
+
 mobile_image_mounter_error_t mobile_image_mounter_hangup(mobile_image_mounter_client_t client)
 {
         if (!client) {
@@ -324,3 +378,215 @@ leave_unlock:
         mobile_image_mounter_unlock(client);
         return res;
 }
+
+mobile_image_mounter_error_t mobile_image_mounter_query_developer_mode_status(mobile_image_mounter_client_t client, plist_t *result)
+{
+        if (!client || !result) {
+                return MOBILE_IMAGE_MOUNTER_E_INVALID_ARG;
+        }
+        mobile_image_mounter_lock(client);
+
+        plist_t dict = plist_new_dict();
+        plist_dict_set_item(dict, "Command", plist_new_string("QueryDeveloperModeStatus"));
+        mobile_image_mounter_error_t res = mobile_image_mounter_error(property_list_service_send_xml_plist(client->parent, dict));
+        plist_free(dict);
+
+        if (res != MOBILE_IMAGE_MOUNTER_E_SUCCESS) {
+                debug_info("%s: Error sending XML plist to device!", __func__);
+                goto leave_unlock;
+        }
+
+        res = mobile_image_mounter_error(property_list_service_receive_plist(client->parent, result));
+        if (res != MOBILE_IMAGE_MOUNTER_E_SUCCESS) {
+                debug_info("%s: Error receiving response from device!", __func__);
+        }
+
+leave_unlock:
+        mobile_image_mounter_unlock(client);
+        return res;
+}
+
+mobile_image_mounter_error_t mobile_image_mounter_query_nonce(mobile_image_mounter_client_t client, const char* image_type, unsigned char** nonce, unsigned int* nonce_size)
+{
+        if (!client || !nonce || !nonce_size) {
+                return MOBILE_IMAGE_MOUNTER_E_INVALID_ARG;
+        }
+        mobile_image_mounter_lock(client);
+
+        plist_t dict = plist_new_dict();
+        plist_dict_set_item(dict, "Command", plist_new_string("QueryNonce"));
+        if (image_type) {
+                plist_dict_set_item(dict, "PersonalizedImageType", plist_new_string(image_type));
+        }
+        mobile_image_mounter_error_t res = mobile_image_mounter_error(property_list_service_send_xml_plist(client->parent, dict));
+        plist_free(dict);
+
+        if (res != MOBILE_IMAGE_MOUNTER_E_SUCCESS) {
+                debug_info("%s: Error sending XML plist to device!", __func__);
+                goto leave_unlock;
+        }
+
+        plist_t result = NULL;
+        res = mobile_image_mounter_error(property_list_service_receive_plist(client->parent, &result));
+        if (res != MOBILE_IMAGE_MOUNTER_E_SUCCESS) {
+                debug_info("%s: Error receiving response from device!", __func__);
+        } else {
+                plist_t p_nonce = plist_dict_get_item(result, "PersonalizationNonce");
+                if (!p_nonce) {
+                        res = MOBILE_IMAGE_MOUNTER_E_NOT_SUPPORTED;
+                } else {
+                        uint64_t nonce_size_ = 0;
+                        plist_get_data_val(p_nonce, (char**)nonce, &nonce_size_);
+                        if (*nonce) {
+                                *nonce_size = (unsigned int)nonce_size_;
+                        } else {
+                                res = MOBILE_IMAGE_MOUNTER_E_COMMAND_FAILED;
+                        }
+                }
+        }
+        plist_free(result);
+
+leave_unlock:
+        mobile_image_mounter_unlock(client);
+        return res;
+}
+
+mobile_image_mounter_error_t mobile_image_mounter_query_personalization_identifiers(mobile_image_mounter_client_t client, const char* image_type, plist_t *result)
+{
+        if (!client || !result) {
+                return MOBILE_IMAGE_MOUNTER_E_INVALID_ARG;
+        }
+        mobile_image_mounter_lock(client);
+
+        plist_t dict = plist_new_dict();
+        plist_dict_set_item(dict, "Command", plist_new_string("QueryPersonalizationIdentifiers"));
+        if (image_type) {
+                plist_dict_set_item(dict, "PersonalizedImageType", plist_new_string(image_type));
+        }
+        mobile_image_mounter_error_t res = mobile_image_mounter_error(property_list_service_send_xml_plist(client->parent, dict));
+        plist_free(dict);
+
+        if (res != MOBILE_IMAGE_MOUNTER_E_SUCCESS) {
+                debug_info("%s: Error sending XML plist to device!", __func__);
+                goto leave_unlock;
+        }
+
+        plist_t _result = NULL;
+        res = mobile_image_mounter_error(property_list_service_receive_plist(client->parent, &_result));
+        if (res != MOBILE_IMAGE_MOUNTER_E_SUCCESS) {
+                debug_info("%s: Error receiving response from device!", __func__);
+        }
+        *result = plist_copy(plist_dict_get_item(_result, "PersonalizationIdentifiers"));
+        if (!*result) {
+                debug_info("%s: Response did not contain PersonalizationIdentifiers!", __func__);
+                res = MOBILE_IMAGE_MOUNTER_E_COMMAND_FAILED;
+        }
+
+leave_unlock:
+        mobile_image_mounter_unlock(client);
+        return res;
+}
+
+mobile_image_mounter_error_t mobile_image_mounter_query_personalization_manifest(mobile_image_mounter_client_t client, const char* image_type, const unsigned char* signature, unsigned int signature_size, unsigned char** manifest, unsigned int* manifest_size)
+{
+        if (!client || !image_type || !signature || !signature_size || !manifest || !manifest_size) {
+                return MOBILE_IMAGE_MOUNTER_E_INVALID_ARG;
+        }
+        mobile_image_mounter_lock(client);
+
+        plist_t dict = plist_new_dict();
+        plist_dict_set_item(dict, "Command", plist_new_string("QueryPersonalizationManifest"));
+        plist_dict_set_item(dict, "PersonalizedImageType", plist_new_string(image_type));
+        plist_dict_set_item(dict, "ImageType", plist_new_string(image_type));
+        plist_dict_set_item(dict, "ImageSignature", plist_new_data((char*)signature, signature_size));
+
+        mobile_image_mounter_error_t res = mobile_image_mounter_error(property_list_service_send_xml_plist(client->parent, dict));
+        plist_free(dict);
+
+        if (res != MOBILE_IMAGE_MOUNTER_E_SUCCESS) {
+                debug_info("%s: Error sending XML plist to device!", __func__);
+                goto leave_unlock;
+        }
+
+        plist_t result = NULL;
+        res = mobile_image_mounter_error(property_list_service_receive_plist(client->parent, &result));
+        if (res != MOBILE_IMAGE_MOUNTER_E_SUCCESS) {
+                debug_info("%s: Error receiving response from device!", __func__);
+        } else {
+                plist_t p_manifest = plist_dict_get_item(result, "ImageSignature");
+                if (!p_manifest) {
+                        res = MOBILE_IMAGE_MOUNTER_E_NOT_SUPPORTED;
+                } else {
+                        uint64_t manifest_size_ = 0;
+                        plist_get_data_val(p_manifest, (char**)manifest, &manifest_size_);
+                        if (*manifest) {
+                                *manifest_size = (unsigned int)manifest_size_;
+                        } else {
+                                res = MOBILE_IMAGE_MOUNTER_E_COMMAND_FAILED;
+                        }
+                }
+        }
+        plist_free(result);
+
+leave_unlock:
+        mobile_image_mounter_unlock(client);
+        return res;
+}
+
+mobile_image_mounter_error_t mobile_image_mounter_roll_personalization_nonce(mobile_image_mounter_client_t client)
+{
+        if (!client) {
+                return MOBILE_IMAGE_MOUNTER_E_INVALID_ARG;
+        }
+        mobile_image_mounter_lock(client);
+
+        plist_t dict = plist_new_dict();
+        plist_dict_set_item(dict, "Command", plist_new_string("RollPersonalizationNonce"));
+        mobile_image_mounter_error_t res = mobile_image_mounter_error(property_list_service_send_xml_plist(client->parent, dict));
+        plist_free(dict);
+
+        if (res != MOBILE_IMAGE_MOUNTER_E_SUCCESS) {
+                debug_info("%s: Error sending XML plist to device!", __func__);
+                goto leave_unlock;
+        }
+
+        plist_t result = NULL;
+        res = mobile_image_mounter_error(property_list_service_receive_plist(client->parent, &result));
+        if (res != MOBILE_IMAGE_MOUNTER_E_SUCCESS) {
+                debug_info("%s: Error receiving response from device!", __func__);
+        }
+        plist_free(result);
+
+leave_unlock:
+        mobile_image_mounter_unlock(client);
+        return res;
+}
+
+mobile_image_mounter_error_t mobile_image_mounter_roll_cryptex_nonce(mobile_image_mounter_client_t client)
+{
+        if (!client) {
+                return MOBILE_IMAGE_MOUNTER_E_INVALID_ARG;
+        }
+        mobile_image_mounter_lock(client);
+
+        plist_t dict = plist_new_dict();
+        plist_dict_set_item(dict, "Command", plist_new_string("RollCryptexNonce"));
+        mobile_image_mounter_error_t res = mobile_image_mounter_error(property_list_service_send_xml_plist(client->parent, dict));
+        plist_free(dict);
+
+        if (res != MOBILE_IMAGE_MOUNTER_E_SUCCESS) {
+                debug_info("%s: Error sending XML plist to device!", __func__);
+                goto leave_unlock;
+        }
+
+        plist_t result = NULL;
+        res = mobile_image_mounter_error(property_list_service_receive_plist(client->parent, &result));
+        if (res != MOBILE_IMAGE_MOUNTER_E_SUCCESS) {
+                debug_info("%s: Error receiving response from device!", __func__);
+        }
+        plist_free(result);
+
+leave_unlock:
+        mobile_image_mounter_unlock(client);
+        return res;
+}
diff --git a/tools/Makefile.am b/tools/Makefile.am
index 4cac1fc..7c9060b 100644
--- a/tools/Makefile.am
+++ b/tools/Makefile.am
@@ -66,7 +66,7 @@ idevice_id_LDADD = $(top_builddir)/src/libimobiledevice-1.0.la
 
 idevicebackup_SOURCES = idevicebackup.c
 idevicebackup_CFLAGS = $(AM_CFLAGS) $(limd_glue_CFLAGS)
-idevicebackup_LDFLAGS = $(AM_LDFLAGS) $(ssl_lib_LIBS) $(limd_glue_LIBS)
+idevicebackup_LDFLAGS = $(AM_LDFLAGS) $(limd_glue_LIBS)
 idevicebackup_LDADD = $(top_builddir)/src/libimobiledevice-1.0.la
 
 idevicebackup2_SOURCES = idevicebackup2.c
@@ -75,8 +75,8 @@ idevicebackup2_LDFLAGS = $(AM_LDFLAGS) $(limd_glue_LIBS)
 idevicebackup2_LDADD = $(top_builddir)/src/libimobiledevice-1.0.la
 
 ideviceimagemounter_SOURCES = ideviceimagemounter.c
-ideviceimagemounter_CFLAGS = $(AM_CFLAGS) $(limd_glue_CFLAGS)
-ideviceimagemounter_LDFLAGS = $(AM_LDFLAGS) $(limd_glue_LIBS)
+ideviceimagemounter_CFLAGS = $(AM_CFLAGS) $(limd_glue_CFLAGS) $(libtatsu_CFLAGS)
+ideviceimagemounter_LDFLAGS = $(AM_LDFLAGS) $(limd_glue_LIBS) $(ssl_lib_LIBS) $(libtatsu_LIBS)
 ideviceimagemounter_LDADD = $(top_builddir)/src/libimobiledevice-1.0.la
 
 idevicescreenshot_SOURCES = idevicescreenshot.c
diff --git a/tools/ideviceimagemounter.c b/tools/ideviceimagemounter.c
index f551b6c..52b0666 100644
--- a/tools/ideviceimagemounter.c
+++ b/tools/ideviceimagemounter.c
@@ -45,8 +45,11 @@
 #include <libimobiledevice/afc.h>
 #include <libimobiledevice/notification_proxy.h>
 #include <libimobiledevice/mobile_image_mounter.h>
+#include <libimobiledevice-glue/sha.h>
+#include <libimobiledevice-glue/utils.h>
 #include <asprintf.h>
 #include <plist/plist.h>
+#include <libtatsu/tss.h>
 
 static int list_mode = 0;
 static int use_network = 0;
@@ -62,18 +65,38 @@ typedef enum {
         DISK_IMAGE_UPLOAD_TYPE_UPLOAD_IMAGE
 } disk_image_upload_type_t;
 
+enum cmd_mode {
+        CMD_NONE = 0,
+        CMD_MOUNT,
+        CMD_UNMOUNT,
+        CMD_LIST,
+        CMD_DEVMODESTATUS
+};
+
+int cmd = CMD_NONE;
+
 static void print_usage(int argc, char **argv, int is_error)
 {
         char *name = strrchr(argv[0], '/');
-        fprintf(is_error ? stderr : stdout, "Usage: %s [OPTIONS] IMAGE_FILE IMAGE_SIGNATURE_FILE\n", (name ? name + 1: argv[0]));
+        fprintf(is_error ? stderr : stdout, "Usage: %s [OPTIONS] COMMAND [COMMAND OPTIONS...]\n", (name ? name + 1: argv[0]));
         fprintf(is_error ? stderr : stdout,
                 "\n"
-                "Mounts the specified disk image on the device.\n"
+                "Mount, list, or unmount a disk image on the device.\n"
+                "\n"
+                "COMMANDS:\n"
+                "  mount PATH     Mount the developer disk image at PATH.\n"
+                "                 For iOS 17+, PATH is a directory containing a .dmg image,\n"
+                "                 a BuildManifest.plist, and a Firmware sub-directory;\n"
+                "                 for older versions PATH is a .dmg filename with a"
+                "                 .dmg.signature in the same directory, or with another\n"
+                "                 parameter pointing to a file elsewhere.\n"
+                "  list           List mounted disk images.\n"
+                "  unmount PATH   Unmount the image mounted at PATH.\n"
+                "  devmodestatus  Query the developer mode status (iOS 16+)\n"
                 "\n"
                 "OPTIONS:\n"
                 "  -u, --udid UDID       target specific device by UDID\n"
                 "  -n, --network         connect to network device\n"
-                "  -l, --list            List mount information\n"
                 "  -t, --imagetype TYPE  Image type to use, default is 'Developer'\n"
                 "  -x, --xml             Use XML output\n"
                 "  -d, --debug           enable communication debugging\n"
@@ -87,11 +110,11 @@ static void print_usage(int argc, char **argv, int is_error)
 
 static void parse_opts(int argc, char **argv)
 {
+        int debug_level = 0;
         static struct option longopts[] = {
                 { "help",      no_argument,       NULL, 'h' },
                 { "udid",      required_argument, NULL, 'u' },
                 { "network",   no_argument,       NULL, 'n' },
-                { "list",      no_argument,       NULL, 'l' },
                 { "imagetype", required_argument, NULL, 't' },
                 { "xml",       no_argument,       NULL, 'x' },
                 { "debug",     no_argument,       NULL, 'd' },
@@ -101,7 +124,7 @@ static void parse_opts(int argc, char **argv)
         int c;
 
         while (1) {
-                c = getopt_long(argc, argv, "hu:lt:xdnv", longopts, NULL);
+                c = getopt_long(argc, argv, "hu:t:xdnv", longopts, NULL);
                 if (c == -1) {
                         break;
                 }
@@ -121,9 +144,6 @@ static void parse_opts(int argc, char **argv)
                 case 'n':
                         use_network = 1;
                         break;
-                case 'l':
-                        list_mode = 1;
-                        break;
                 case 't':
                         imagetype = optarg;
                         break;
@@ -131,7 +151,7 @@ static void parse_opts(int argc, char **argv)
                         xml_mode = 1;
                         break;
                 case 'd':
-                        idevice_set_debug_level(1);
+                        debug_level++;
                         break;
                 case 'v':
                         printf("%s %s\n", TOOL_NAME, PACKAGE_VERSION);
@@ -141,6 +161,8 @@ static void parse_opts(int argc, char **argv)
                         exit(2);
                 }
         }
+        idevice_set_debug_level(debug_level);
+        tss_set_debug_level(debug_level);
 }
 
 static ssize_t mim_upload_cb(void* buf, size_t size, void* userdata)
@@ -169,29 +191,75 @@ int main(int argc, char **argv)
         argc -= optind;
         argv += optind;
 
-        if (!list_mode) {
-                if (argc < 1) {
-                        printf("ERROR: No IMAGE_FILE has been given!\n");
-                        return -1;
-                }
-                image_path = strdup(argv[0]);
-                if (argc >= 2) {
-                        image_sig_path = strdup(argv[1]);
+        if (argc == 0) {
+                fprintf(stderr, "ERROR: Missing command.\n\n");
+                print_usage(argc+optind, argv-optind, 1);
+                return 2;
+        }
+
+        char* cmdstr = argv[0];
+
+        int optind2 = 0;
+        if (!strcmp(cmdstr, "mount")) {
+                cmd = CMD_MOUNT;
+                optind2++;
+        } else if (!strcmp(cmdstr, "list")) {
+                cmd = CMD_LIST;
+                optind2++;
+        } else if (!strcmp(cmdstr, "umount") || !strcmp(cmdstr, "unmount")) {
+                cmd = CMD_UNMOUNT;
+                optind2++;
+        } else if (!strcmp(cmdstr, "devmodestatus")) {
+                cmd = CMD_DEVMODESTATUS;
+                optind2++;
+        } else {
+                // assume mount command, unless -l / --list was specified
+                if (list_mode) {
+                        cmd = CMD_LIST;
                 } else {
-                        if (asprintf(&image_sig_path, "%s.signature", image_path) < 0) {
-                                printf("Out of memory?!\n");
-                                return -1;
-                        }
+                        cmd = CMD_MOUNT;
                 }
         }
 
+        argc -= optind2;
+        argv += optind2;
+        optind += optind2;
+
+        switch (cmd) {
+                case CMD_MOUNT:
+                        if (argc < 1) {
+                                fprintf(stderr, "ERROR: Missing IMAGE_FILE for mount command\n");
+                                print_usage(argc+optind, argv-optind, 1);
+                                return 2;
+                        }
+                        image_path = strdup(argv[0]);
+                        if (argc >= 2) {
+                                image_sig_path = strdup(argv[1]);
+                        } else {
+                                if (asprintf(&image_sig_path, "%s.signature", image_path) < 0) {
+                                        printf("Out of memory?!\n");
+                                        return 1;
+                                }
+                        }
+                        break;
+                case CMD_UNMOUNT:
+                        if (argc != 1) {
+                                fprintf(stderr, "ERROR: Missing mount path (argc = %d)\n", argc);
+                                print_usage(argc+optind, argv-optind, 1);
+                                return 2;
+                        }
+                        break;
+                default:
+                        break;
+        }
+
         if (IDEVICE_E_SUCCESS != idevice_new_with_options(&device, udid, (use_network) ? IDEVICE_LOOKUP_NETWORK : IDEVICE_LOOKUP_USBMUX)) {
                 if (udid) {
                         printf("No device found with udid %s.\n", udid);
                 } else {
                         printf("No device found.\n");
                 }
-                return -1;
+                return 1;
         }
 
         if (LOCKDOWN_E_SUCCESS != (ldret = lockdownd_client_new_with_handshake(device, &lckd, TOOL_NAME))) {
@@ -215,7 +283,7 @@ int main(int argc, char **argv)
                 }
         }
 
-        if (product_version_major == 16) {
+        if (product_version_major >= 16) {
                 uint8_t dev_mode_status = 0;
                 plist_t val = NULL;
                 ldret = lockdownd_get_value(lckd, "com.apple.security.mac.amfi", "DeveloperModeStatus", &val);
@@ -246,7 +314,7 @@ int main(int argc, char **argv)
                 service = NULL;
         }
 
-        if (!list_mode) {
+        if (cmd == CMD_MOUNT) {
                 struct stat fst;
                 if (disk_image_upload_type == DISK_IMAGE_UPLOAD_TYPE_AFC) {
                         if ((lockdownd_start_service(lckd, "com.apple.afc", &service) !=
@@ -268,7 +336,7 @@ int main(int argc, char **argv)
                         goto leave;
                 }
                 image_size = fst.st_size;
-                if (stat(image_sig_path, &fst) != 0) {
+                if (product_version_major < 17 && stat(image_sig_path, &fst) != 0) {
                         fprintf(stderr, "ERROR: stat: %s: %s\n", image_sig_path, strerror(errno));
                         goto leave;
                 }
@@ -280,10 +348,14 @@ int main(int argc, char **argv)
         mobile_image_mounter_error_t err = MOBILE_IMAGE_MOUNTER_E_UNKNOWN_ERROR;
         plist_t result = NULL;
 
-        if (list_mode) {
+        if (cmd == CMD_LIST) {
                 /* list mounts mode */
                 if (!imagetype) {
-                        imagetype = "Developer";
+                        if (product_version_major < 17) {
+                                imagetype = "Developer";
+                        } else {
+                                imagetype = "Personalized";
+                        }
                 }
                 err = mobile_image_mounter_lookup_image(mim, imagetype, &result);
                 if (err == MOBILE_IMAGE_MOUNTER_E_SUCCESS) {
@@ -292,25 +364,214 @@ int main(int argc, char **argv)
                 } else {
                         printf("Error: lookup_image returned %d\n", err);
                 }
-        } else {
-                char sig[8192];
+        } else if (cmd == CMD_MOUNT) {
+                unsigned char *sig = NULL;
                 size_t sig_length = 0;
-                FILE *f = fopen(image_sig_path, "rb");
-                if (!f) {
-                        fprintf(stderr, "Error opening signature file '%s': %s\n", image_sig_path, strerror(errno));
-                        goto leave;
-                }
-                sig_length = fread(sig, 1, sizeof(sig), f);
-                fclose(f);
-                if (sig_length == 0) {
-                        fprintf(stderr, "Could not read signature from file '%s'\n", image_sig_path);
-                        goto leave;
-                }
+                FILE *f;
+                struct stat fst;
+                plist_t mount_options = NULL;
 
-                f = fopen(image_path, "rb");
-                if (!f) {
-                        fprintf(stderr, "Error opening image file '%s': %s\n", image_path, strerror(errno));
-                        goto leave;
+                if (product_version_major < 17) {
+                        f = fopen(image_sig_path, "rb");
+                        if (!f) {
+                                fprintf(stderr, "Error opening signature file '%s': %s\n", image_sig_path, strerror(errno));
+                                goto leave;
+                        }
+                        fstat(fileno(f), &fst);
+                        sig = malloc(sig_length);
+                        sig_length = fread(sig, 1, fst.st_size, f);
+                        fclose(f);
+                        if (sig_length == 0) {
+                                fprintf(stderr, "Could not read signature from file '%s'\n", image_sig_path);
+                                goto leave;
+                        }
+
+                        f = fopen(image_path, "rb");
+                        if (!f) {
+                                fprintf(stderr, "Error opening image file '%s': %s\n", image_path, strerror(errno));
+                                goto leave;
+                        }
+                } else {
+                        if (stat(image_path, &fst) != 0) {
+                                fprintf(stderr, "Error: stat: '%s': %s\n", image_path, strerror(errno));
+                                goto leave;
+                        }
+                        if (!S_ISDIR(fst.st_mode)) {
+                                fprintf(stderr, "Error: Personalized Disk Image mount expects a directory as image path.\n");
+                                goto leave;
+                        }
+                        char* build_manifest_path = string_build_path(image_path, "BuildManifest.plist", NULL);
+                        plist_t build_manifest = NULL;
+                        if (plist_read_from_file(build_manifest_path, &build_manifest, NULL) != 0) {
+                                free(build_manifest_path);
+                                build_manifest_path = string_build_path(image_path, "Restore", "BuildManifest.plist", NULL);
+                                if (plist_read_from_file(build_manifest_path, &build_manifest, NULL) == 0) {
+                                        char* image_path_new = string_build_path(image_path, "Restore", NULL);
+                                        free(image_path);
+                                        image_path = image_path_new;
+                                }
+                        }
+                        if (!build_manifest) {
+                                fprintf(stderr, "Error: Could not locate BuildManifest.plist inside given disk image path!\n");
+                                goto leave;
+                        }
+
+                        plist_t identifiers = NULL;
+                        mobile_image_mounter_error_t merr = mobile_image_mounter_query_personalization_identifiers(mim, NULL, &identifiers);
+                        if (merr != MOBILE_IMAGE_MOUNTER_E_SUCCESS) {
+                                fprintf(stderr, "Failed to query personalization identifiers: %d\n", merr);
+                                goto error_out;
+                        }
+
+                        unsigned int board_id = plist_dict_get_uint(identifiers, "BoardId");
+                        unsigned int chip_id = plist_dict_get_uint(identifiers, "ChipID");
+
+                        plist_t build_identities = plist_dict_get_item(build_manifest, "BuildIdentities");
+                        plist_array_iter iter;
+                        plist_array_new_iter(build_identities, &iter);
+                        plist_t item = NULL;
+                        plist_t build_identity = NULL;
+                        do {
+                                plist_array_next_item(build_identities, iter, &item);
+                                if (!item) {
+                                        break;
+                                }
+                                unsigned int bi_board_id = (unsigned int)plist_dict_get_uint(item, "ApBoardID");
+                                unsigned int bi_chip_id = (unsigned int)plist_dict_get_uint(item, "ApChipID");
+                                if (bi_chip_id == chip_id && bi_board_id == board_id) {
+                                        build_identity = item;
+                                        break;
+                                }
+                        } while (item);
+                        plist_mem_free(iter);
+                        if (!build_identity) {
+                                fprintf(stderr, "Error: The given disk image is not compatible with the current device.\n");
+                                goto leave;
+                        }
+                        plist_t p_tc_path = plist_access_path(build_identity, 4, "Manifest", "LoadableTrustCache", "Info", "Path");
+                        if (!p_tc_path) {
+                                fprintf(stderr, "Error: Could not determine path for trust cache!\n");
+                                goto leave;
+                        }
+                        plist_t p_dmg_path = plist_access_path(build_identity, 4, "Manifest", "PersonalizedDMG", "Info", "Path");
+                        if (!p_dmg_path) {
+                                fprintf(stderr, "Error: Could not determine path for disk image!\n");
+                                goto leave;
+                        }
+                        char *tc_path = string_build_path(image_path, plist_get_string_ptr(p_tc_path, NULL), NULL);
+                        unsigned char* trust_cache = NULL;
+                        uint64_t trust_cache_size = 0;
+                        if (!buffer_read_from_filename(tc_path, (char**)&trust_cache, &trust_cache_size)) {
+                                fprintf(stderr, "Error: Trust cache does not exist at '%s'!\n", tc_path);
+                                goto leave;
+                        }
+                        mount_options = plist_new_dict();
+                        plist_dict_set_item(mount_options, "ImageTrustCache", plist_new_data((char*)trust_cache, trust_cache_size));
+                        free(trust_cache);
+                        char *dmg_path = string_build_path(image_path, plist_get_string_ptr(p_dmg_path, NULL), NULL);
+                        free(image_path);
+                        image_path = dmg_path;
+                        f = fopen(image_path, "rb");
+                        if (!f) {
+                                fprintf(stderr, "Error opening image file '%s': %s\n", image_path, strerror(errno));
+                                goto leave;
+                        }
+
+                        unsigned char buf[8192];
+                        unsigned char sha384_digest[48];
+                        sha384_context ctx;
+                        sha384_init(&ctx);
+                        fstat(fileno(f), &fst);
+                        image_size = fst.st_size;
+                        while (!feof(f)) {
+                                ssize_t fr = fread(buf, 1, sizeof(buf), f);
+                                if (fr <= 0) {
+                                        break;
+                                }
+                                sha384_update(&ctx, buf, fr);
+                        }
+                        rewind(f);
+                        sha384_final(&ctx, sha384_digest);
+                        unsigned char* manifest = NULL;
+                        unsigned int manifest_size = 0;
+                        /* check if the device already has a personalization manifest for this image */
+                        if (mobile_image_mounter_query_personalization_manifest(mim, "DeveloperDiskImage", sha384_digest, sizeof(sha384_digest), &manifest, &manifest_size) == MOBILE_IMAGE_MOUNTER_E_SUCCESS) {
+                                printf("Using existing personalization manifest from device.\n");
+                        } else {
+                                /* we need to re-connect in this case */
+                                mobile_image_mounter_free(mim);
+                                mim = NULL;
+                                if (mobile_image_mounter_start_service(device, &mim, TOOL_NAME) != MOBILE_IMAGE_MOUNTER_E_SUCCESS) {
+                                        goto error_out;
+                                }
+                                printf("No personalization manifest, requesting from TSS...\n");
+                                unsigned char* nonce = NULL;
+                                unsigned int nonce_size = 0;
+
+                                /* create new TSS request and fill parameters */
+                                plist_t request = tss_request_new(NULL);
+                                plist_t params = plist_new_dict();
+                                tss_parameters_add_from_manifest(params, build_identity, 1);
+
+                                /* copy all `Ap,*` items from identifiers */
+                                plist_dict_iter di = NULL;
+                                plist_dict_new_iter(identifiers, &di);
+                                plist_t node = NULL;
+                                do {
+                                        char* key = NULL;
+                                        plist_dict_next_item(identifiers, di, &key, &node);
+                                        if (node) {
+                                                if (!strncmp(key, "Ap,", 3)) {
+                                                        plist_dict_set_item(request, key, plist_copy(node));
+                                                }
+                                        }
+                                        free(key);
+                                } while (node);
+                                plist_mem_free(di);
+
+                                plist_dict_copy_uint(params, identifiers, "ApECID", "UniqueChipID");
+                                plist_dict_set_item(params, "ApProductionMode", plist_new_bool(1));
+                                plist_dict_set_item(params, "ApSecurityMode", plist_new_bool(1));
+                                plist_dict_set_item(params, "ApSupportsImg4", plist_new_bool(1));
+
+                                /* query nonce from image mounter service */
+                                merr = mobile_image_mounter_query_nonce(mim, "DeveloperDiskImage", &nonce, &nonce_size);
+                                if (merr == MOBILE_IMAGE_MOUNTER_E_SUCCESS) {
+                                        plist_dict_set_item(params, "ApNonce", plist_new_data((char*)nonce, nonce_size));
+                                } else {
+                                        fprintf(stderr, "ERROR: Failed to query nonce for developer disk image: %d\n", merr);
+                                        goto error_out;
+                                }
+                                mobile_image_mounter_free(mim);
+                                mim = NULL;
+
+                                plist_dict_set_item(params, "ApSepNonce", plist_new_data("\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 20));
+                                plist_dict_set_item(params, "UID_MODE", plist_new_bool(0));
+                                tss_request_add_ap_tags(request, params, NULL);
+                                tss_request_add_common_tags(request, params, NULL);
+                                tss_request_add_ap_img4_tags(request, params);
+                                plist_free(params);
+
+                                /* request IM4M from TSS */
+                                plist_t response = tss_request_send(request, NULL);
+                                plist_free(request);
+
+                                plist_t p_manifest = plist_dict_get_item(response, "ApImg4Ticket");
+                                if (!PLIST_IS_DATA(p_manifest)) {
+                                        fprintf(stderr, "Failed to get Img4Ticket\n");
+                                        goto error_out;
+                                }
+
+                                uint64_t m4m_len = 0;
+                                plist_get_data_val(p_manifest, (char**)&manifest, &m4m_len);
+                                manifest_size = m4m_len;
+                                plist_free(response);
+                                printf("Done.\n");
+                        }
+                        sig = manifest;
+                        sig_length = manifest_size;
+
+                        imagetype = "Personalized";
                 }
 
                 char *targetname = NULL;
@@ -324,11 +585,16 @@ int main(int argc, char **argv)
                         goto leave;
                 }
 
-
                 if (!imagetype) {
                         imagetype = "Developer";
                 }
 
+                if (!mim) {
+                        if (mobile_image_mounter_start_service(device, &mim, TOOL_NAME) != MOBILE_IMAGE_MOUNTER_E_SUCCESS) {
+                                goto error_out;
+                        }
+                }
+
                 switch(disk_image_upload_type) {
                         case DISK_IMAGE_UPLOAD_TYPE_UPLOAD_IMAGE:
                                 printf("Uploading %s\n", image_path);
@@ -403,7 +669,7 @@ int main(int argc, char **argv)
                 printf("done.\n");
 
                 printf("Mounting...\n");
-                err = mobile_image_mounter_mount_image(mim, mountname, sig, sig_length, imagetype, &result);
+                err = mobile_image_mounter_mount_image_with_options(mim, mountname, sig, sig_length, imagetype, mount_options, &result);
                 if (err == MOBILE_IMAGE_MOUNTER_E_SUCCESS) {
                         if (result) {
                                 plist_t node = plist_dict_get_item(result, "Status");
@@ -435,7 +701,10 @@ int main(int argc, char **argv)
                                                 printf("unexpected result:\n");
                                                 plist_write_to_stream(result, stdout, (xml_mode) ? PLIST_FORMAT_XML : PLIST_FORMAT_LIMD, 0);
                                         }
-
+                                        node = plist_dict_get_item(result, "DetailedError");
+                                        if (node) {
+                                                printf("DetailedError: %s\n", plist_get_string_ptr(node, NULL));
+                                        }
                                 } else {
                                         plist_write_to_stream(result, stdout, (xml_mode) ? PLIST_FORMAT_XML : PLIST_FORMAT_LIMD, 0);
                                 }
@@ -444,6 +713,37 @@ int main(int argc, char **argv)
                         printf("Error: mount_image returned %d\n", err);
 
                 }
+        } else if (cmd == CMD_UNMOUNT) {
+                err = mobile_image_mounter_unmount_image(mim, argv[0]);
+                switch (err) {
+                        case MOBILE_IMAGE_MOUNTER_E_SUCCESS:
+                                printf("Success\n");
+                                res = 0;
+                                break;
+                        case MOBILE_IMAGE_MOUNTER_E_COMMAND_FAILED:
+                                printf("Error: '%s' is not mounted\n", argv[0]);
+                                res = 1;
+                                break;
+                        case MOBILE_IMAGE_MOUNTER_E_NOT_SUPPORTED:
+                                printf("Error: 'unmount' is not supported on this device\n");
+                                res = 1;
+                                break;
+                        case MOBILE_IMAGE_MOUNTER_E_DEVICE_LOCKED:
+                                printf("Error: device is locked\n");
+                                res = 1;
+                                break;
+                        default:
+                                printf("Error: unmount returned %d\n", err);
+                                break;
+                }
+        } else if (cmd == CMD_DEVMODESTATUS) {
+                err = mobile_image_mounter_query_developer_mode_status(mim, &result);
+                if (err == MOBILE_IMAGE_MOUNTER_E_SUCCESS) {
+                        res = 0;
+                        plist_write_to_stream(result, stdout, (xml_mode) ? PLIST_FORMAT_XML : PLIST_FORMAT_LIMD, 0);
+                } else {
+                        printf("Error: query_developer_mode_status returned %d\n", err);
+                }
         }
 
         if (result) {
@@ -466,7 +766,7 @@ leave:
         idevice_free(device);
 
         if (image_path)
-                        free(image_path);
+                free(image_path);
         if (image_sig_path)
                 free(image_sig_path);