1 files changed, 495 insertions, 512 deletions

diff --git a/src/lockdown.c b/src/lockdown.c
index 73a8bbc..e720b29 100644
--- a/src/lockdown.c
+++ b/src/lockdown.c
@@ -1,22 +1,22 @@
 /*
  * lockdown.c
  * libiphone built-in lockdownd client
- * 
+ *
  * Copyright (c) 2008 Zach C. All Rights Reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Lesser General Public
  * License as published by the Free Software Foundation; either
  * version 2.1 of the License, or (at your option) any later version.
- * 
+ *
  * This library is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  * Lesser General Public License for more details.
- * 
+ *
  * You should have received a copy of the GNU Lesser General Public
  * License along with this library; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA 
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
  */
 
 #include "usbmux.h"
@@ -31,6 +31,9 @@
 #include <libtasn1.h>
 #include <gnutls/x509.h>
 
+#include <plist/plist.h>
+
+
 const ASN1_ARRAY_TYPE pkcs1_asn1_tab[] = {
         {"PKCS1", 536872976, 0},
         {0, 1073741836, 0},
@@ -40,35 +43,6 @@ const ASN1_ARRAY_TYPE pkcs1_asn1_tab[] = {
         {0, 0, 0}
 };
 
-static int get_rand(int min, int max)
-{
-        int retval = (rand() % (max - min)) + min;
-        return retval;
-}
-
-/** Generates a valid HostID (which is actually a UUID).
- *
- * @param A null terminated string containing a valid HostID.
- */
-char *lockdownd_generate_hostid(void)
-{
-        char *hostid = (char *) malloc(sizeof(char) * 37);      // HostID's are just UUID's, and UUID's are 36 characters long
-        const char *chars = "ABCDEF0123456789";
-        srand(time(NULL));
-        int i = 0;
-
-        for (i = 0; i < 36; i++) {
-                if (i == 8 || i == 13 || i == 18 || i == 23) {
-                        hostid[i] = '-';
-                        continue;
-                } else {
-                        hostid[i] = chars[get_rand(0, 16)];
-                }
-        }
-        hostid[36] = '\0';                      // make it a real string
-        return hostid;
-}
-
 /** Creates a lockdownd client for the give iPhone.
  *
  * @param phone The iPhone to create a lockdownd client for
@@ -93,69 +67,68 @@ iphone_lckd_client_t new_lockdownd_client(iphone_device_t phone)
 
 /**
  * Closes the lockdownd communication session, by sending
- * the StopSession Request to the device. 
+ * the StopSession Request to the device.
  *
  * @param control The lockdown client
  */
 static void iphone_lckd_stop_session(iphone_lckd_client_t control)
 {
         if (!control)
-                return;                                 // IPHONE_E_INVALID_ARG;
-        xmlDocPtr plist = new_plist();
-        xmlNode *dict, *key;
-        char **dictionary;
-        int bytes = 0, i = 0;
+                return;                                 //IPHONE_E_INVALID_ARG;
+
         iphone_error_t ret = IPHONE_E_UNKNOWN_ERROR;
 
-        log_debug_msg("lockdownd_stop_session() called\n");
-        dict = add_child_to_plist(plist, "dict", "\n", NULL, 0);
-        key = add_key_str_dict_element(plist, dict, "Request", "StopSession", 1);
-        key = add_key_str_dict_element(plist, dict, "SessionID", control->session_id, 1);
+        plist_t dict = plist_new_dict();
+        plist_add_sub_key_el(dict, "Request");
+        plist_add_sub_string_el(dict, "StopSession");
+        plist_add_sub_key_el(dict, "SessionID");
+        plist_add_sub_string_el(dict, control->session_id);
 
-        char *XML_content;
-        uint32 length;
+        log_dbg_msg(DBGMASK_LOCKDOWND, "iphone_lckd_stop_session() called\n");
 
-        xmlDocDumpMemory(plist, (xmlChar **) & XML_content, &length);
-        ret = iphone_lckd_send(control, XML_content, length, &bytes);
+        ret = iphone_lckd_send(control, dict);
 
-        xmlFree(XML_content);
-        xmlFreeDoc(plist);
-        plist = NULL;
-        ret = iphone_lckd_recv(control, &XML_content, &bytes);
+        plist_free(dict);
+        dict = NULL;
+
+        ret = iphone_lckd_recv(control, &dict);
 
-        plist = xmlReadMemory(XML_content, bytes, NULL, NULL, 0);
-        if (!plist) {
-                log_debug_msg("lockdownd_stop_session(): IPHONE_E_PLIST_ERROR\n");
-                return;                                 //IPHONE_E_PLIST_ERROR;
-        }
-        dict = xmlDocGetRootElement(plist);
-        for (dict = dict->children; dict; dict = dict->next) {
-                if (!xmlStrcmp(dict->name, "dict"))
-                        break;
-        }
         if (!dict) {
-                log_debug_msg("lockdownd_stop_session(): IPHONE_E_DICT_ERROR\n");
-                return;                                 //IPHONE_E_DICT_ERROR;
+                log_dbg_msg(DBGMASK_LOCKDOWND, "lockdownd_stop_session(): IPHONE_E_PLIST_ERROR\n");
+                return;                                 // IPHONE_E_PLIST_ERROR;
         }
-        dictionary = read_dict_element_strings(dict);
-        xmlFreeDoc(plist);
-        free(XML_content);
 
-        for (i = 0; dictionary[i]; i += 2) {
-                if (!strcmp(dictionary[i], "Result") && !strcmp(dictionary[i + 1], "Success")) {
-                        log_debug_msg("lockdownd_stop_session(): success\n");
+        plist_t query_node = plist_find_node_by_string(dict, "StopSession");
+        plist_t result_node = plist_get_next_sibling(query_node);
+        plist_t value_node = plist_get_next_sibling(result_node);
+
+        plist_type result_type = plist_get_node_type(result_node);
+        plist_type value_type = plist_get_node_type(value_node);
+
+        if (result_type == PLIST_KEY && value_type == PLIST_STRING) {
+
+                char *result_value = NULL;
+                char *value_value = NULL;
+
+                plist_get_key_val(result_node, &result_value);
+                plist_get_string_val(value_node, &value_value);
+
+                if (!strcmp(result_value, "Result") && !strcmp(value_value, "Success")) {
+                        log_dbg_msg(DBGMASK_LOCKDOWND, "lockdownd_stop_session(): success\n");
                         ret = IPHONE_E_SUCCESS;
-                        break;
                 }
+                free(result_value);
+                free(value_value);
         }
+        plist_free(dict);
+        dict = NULL;
 
-        free_dictionary(dictionary);
-        return;                                         //ret;
+        return;                                         // ret;
 }
 
 /**
  * Shuts down the SSL session by first calling iphone_lckd_stop_session
- * to cleanly close the lockdownd communication session, and then 
+ * to cleanly close the lockdownd communication session, and then
  * performing a close notify, which is done by "gnutls_bye".
  *
  * @param client The lockdown client
@@ -163,14 +136,14 @@ static void iphone_lckd_stop_session(iphone_lckd_client_t control)
 static void iphone_lckd_stop_SSL_session(iphone_lckd_client_t client)
 {
         if (!client) {
-                log_debug_msg("lockdownd_stop_SSL_session(): invalid argument!\n");
+                log_dbg_msg(DBGMASK_LOCKDOWND, "lockdownd_stop_SSL_session(): invalid argument!\n");
                 return;
         }
 
         if (client->in_SSL) {
-                log_debug_msg("Stopping SSL Session\n");
+                log_dbg_msg(DBGMASK_LOCKDOWND, "Stopping SSL Session\n");
                 iphone_lckd_stop_session(client);
-                log_debug_msg("Sending SSL close notify\n");
+                log_dbg_msg(DBGMASK_LOCKDOWND, "Sending SSL close notify\n");
                 gnutls_bye(*client->ssl_session, GNUTLS_SHUT_RDWR);
         }
         if (client->ssl_session) {
@@ -215,13 +188,13 @@ iphone_error_t iphone_lckd_free_client(iphone_lckd_client_t client)
  *
  * @return The number of bytes received
  */
-iphone_error_t iphone_lckd_recv(iphone_lckd_client_t client, char **dump_data, uint32_t * recv_bytes)
+iphone_error_t iphone_lckd_recv(iphone_lckd_client_t client, plist_t * plist)
 {
-        if (!client || !dump_data || !recv_bytes)
+        if (!client || !plist || (plist && *plist))
                 return IPHONE_E_INVALID_ARG;
         iphone_error_t ret = IPHONE_E_UNKNOWN_ERROR;
         char *receive;
-        uint32 datalen = 0, bytes = 0;
+        uint32_t datalen = 0, bytes = 0;
 
         if (!client->in_SSL)
                 ret = iphone_mux_recv(client->connection, (char *) &datalen, sizeof(datalen), &bytes);
@@ -240,36 +213,52 @@ iphone_error_t iphone_lckd_recv(iphone_lckd_client_t client, char **dump_data, u
                 if (bytes > 0)
                         ret = IPHONE_E_SUCCESS;
         }
-        *dump_data = receive;
-        *recv_bytes = bytes;
+
+        if (bytes <= 0) {
+                free(receive);
+                return IPHONE_E_NOT_ENOUGH_DATA;
+        }
+
+        log_dbg_msg(DBGMASK_LOCKDOWND, "Recv msg :\nsize : %i\nbuffer :\n%s\n", bytes, receive);
+        plist_from_xml(receive, bytes, plist);
+        free(receive);
+
+        if (!*plist)
+                ret = IPHONE_E_PLIST_ERROR;
+
         return ret;
 }
 
 /** Sends lockdownd data to the iPhone
- * 
+ *
  * @note This function is low-level and should only be used if you need to send
  *        a new type of message.
  *
- * @param control The lockdownd client
- * @param raw_data The null terminated string buffer to send
- * @param length The length of data to send
+ * @param client The lockdownd client
+ * @param plist The plist to send
  *
- * @return The number of bytes sent
+ * @return an error code (IPHONE_E_SUCCESS on success)
  */
-iphone_error_t iphone_lckd_send(iphone_lckd_client_t client, char *raw_data, uint32_t length, uint32_t * sent_bytes)
+iphone_error_t iphone_lckd_send(iphone_lckd_client_t client, plist_t plist)
 {
-        if (!client || !raw_data || length == 0 || !sent_bytes)
+        if (!client || !plist)
                 return IPHONE_E_INVALID_ARG;
         char *real_query;
         int bytes;
+        char *XMLContent = NULL;
+        uint32_t length = 0;
         iphone_error_t ret = IPHONE_E_UNKNOWN_ERROR;
 
+        plist_to_xml(plist, &XMLContent, &length);
+        log_dbg_msg(DBGMASK_LOCKDOWND, "Send msg :\nsize : %i\nbuffer :\n%s\n", length, XMLContent);
+
+
         real_query = (char *) malloc(sizeof(char) * (length + 4));
         length = htonl(length);
         memcpy(real_query, &length, sizeof(length));
-        memcpy(real_query + 4, raw_data, ntohl(length));
-        log_debug_msg("lockdownd_send(): made the query, sending it along\n");
-        dump_debug_buffer("grpkt", real_query, ntohl(length) + 4);
+        memcpy(real_query + 4, XMLContent, ntohl(length));
+        free(XMLContent);
+        log_dbg_msg(DBGMASK_LOCKDOWND, "lockdownd_send(): made the query, sending it along\n");
 
         if (!client->in_SSL)
                 ret = iphone_mux_send(client->connection, real_query, ntohl(length) + sizeof(length), &bytes);
@@ -277,14 +266,14 @@ iphone_error_t iphone_lckd_send(iphone_lckd_client_t client, char *raw_data, uin
                 gnutls_record_send(*client->ssl_session, real_query, ntohl(length) + sizeof(length));
                 ret = IPHONE_E_SUCCESS;
         }
-        log_debug_msg("lockdownd_send(): sent it!\n");
+        log_dbg_msg(DBGMASK_LOCKDOWND, "lockdownd_send(): sent it!\n");
         free(real_query);
-        *sent_bytes = bytes;
+
         return ret;
 }
 
 /** Initiates the handshake for the lockdown session. Part of the lockdownd handshake.
- * 
+ *
  * @note You most likely want lockdownd_init unless you are doing something special.
  *
  * @param control The lockdownd client
@@ -295,49 +284,50 @@ iphone_error_t lockdownd_hello(iphone_lckd_client_t control)
 {
         if (!control)
                 return IPHONE_E_INVALID_ARG;
-        xmlDocPtr plist = new_plist();
-        xmlNode *dict, *key;
-        char **dictionary;
-        int bytes = 0, i = 0;
+
         iphone_error_t ret = IPHONE_E_UNKNOWN_ERROR;
 
-        log_debug_msg("lockdownd_hello() called\n");
-        dict = add_child_to_plist(plist, "dict", "\n", NULL, 0);
-        key = add_key_str_dict_element(plist, dict, "Request", "QueryType", 1);
-        char *XML_content;
-        uint32 length;
+        plist_t dict = plist_new_dict();
+        plist_add_sub_key_el(dict, "Request");
+        plist_add_sub_string_el(dict, "QueryType");
 
-        xmlDocDumpMemory(plist, (xmlChar **) & XML_content, &length);
-        ret = iphone_lckd_send(control, XML_content, length, &bytes);
+        log_dbg_msg(DBGMASK_LOCKDOWND, "lockdownd_hello() called\n");
+        ret = iphone_lckd_send(control, dict);
 
-        xmlFree(XML_content);
-        xmlFreeDoc(plist);
-        plist = NULL;
-        ret = iphone_lckd_recv(control, &XML_content, &bytes);
+        plist_free(dict);
+        dict = NULL;
 
-        plist = xmlReadMemory(XML_content, bytes, NULL, NULL, 0);
-        if (!plist)
-                return IPHONE_E_PLIST_ERROR;
-        dict = xmlDocGetRootElement(plist);
-        for (dict = dict->children; dict; dict = dict->next) {
-                if (!xmlStrcmp(dict->name, "dict"))
-                        break;
-        }
-        if (!dict)
-                return IPHONE_E_DICT_ERROR;
-        dictionary = read_dict_element_strings(dict);
-        xmlFreeDoc(plist);
-        free(XML_content);
-
-        for (i = 0; dictionary[i]; i += 2) {
-                if (!strcmp(dictionary[i], "Result") && !strcmp(dictionary[i + 1], "Success")) {
-                        log_debug_msg("lockdownd_hello(): success\n");
+        ret = iphone_lckd_recv(control, &dict);
+
+        if (IPHONE_E_SUCCESS != ret)
+                return ret;
+
+        plist_t query_node = plist_find_node_by_string(dict, "QueryType");
+        plist_t result_node = plist_get_next_sibling(query_node);
+        plist_t value_node = plist_get_next_sibling(result_node);
+
+        plist_type result_type = plist_get_node_type(result_node);
+        plist_type value_type = plist_get_node_type(value_node);
+
+        if (result_type == PLIST_KEY && value_type == PLIST_STRING) {
+
+                char *result_value = NULL;
+                char *value_value = NULL;
+
+                plist_get_key_val(result_node, &result_value);
+                plist_get_string_val(value_node, &value_value);
+
+                if (!strcmp(result_value, "Result") && !strcmp(value_value, "Success")) {
+                        log_dbg_msg(DBGMASK_LOCKDOWND, "lockdownd_hello(): success\n");
                         ret = IPHONE_E_SUCCESS;
-                        break;
                 }
+                free(result_value);
+                free(value_value);
         }
 
-        free_dictionary(dictionary);
+        plist_free(dict);
+        dict = NULL;
+
         return ret;
 }
 
@@ -350,73 +340,100 @@ iphone_error_t lockdownd_hello(iphone_lckd_client_t control)
  * @return IPHONE_E_SUCCESS on success.
  */
 iphone_error_t lockdownd_generic_get_value(iphone_lckd_client_t control, const char *req_key, const char *req_string,
-                                                                                   char **value)
+                                                                                   gnutls_datum_t * value)
 {
-        if (!control || !req_key || !value || (value && *value))
+        if (!control || !req_key || !value || value->data)
                 return IPHONE_E_INVALID_ARG;
-        xmlDocPtr plist = new_plist();
-        xmlNode *dict = NULL;
-        xmlNode *key = NULL;;
-        char **dictionary = NULL;
-        int bytes = 0, i = 0;
-        char *XML_content = NULL;
-        uint32 length = 0;
+
+        plist_t dict = NULL;
         iphone_error_t ret = IPHONE_E_UNKNOWN_ERROR;
 
         /* Setup DevicePublicKey request plist */
-        dict = add_child_to_plist(plist, "dict", "\n", NULL, 0);
-        key = add_key_str_dict_element(plist, dict, req_key, req_string, 1);
-        key = add_key_str_dict_element(plist, dict, "Request", "GetValue", 1);
-        xmlDocDumpMemory(plist, (xmlChar **) & XML_content, &length);
+        dict = plist_new_dict();
+        plist_add_sub_key_el(dict, req_key);
+        plist_add_sub_string_el(dict, req_string);
+        plist_add_sub_key_el(dict, "Request");
+        plist_add_sub_string_el(dict, "GetValue");
 
         /* send to iPhone */
-        ret = iphone_lckd_send(control, XML_content, length, &bytes);
+        ret = iphone_lckd_send(control, dict);
 
-        xmlFree(XML_content);
-        xmlFreeDoc(plist);
-        plist = NULL;
+        plist_free(dict);
+        dict = NULL;
 
         if (ret != IPHONE_E_SUCCESS)
                 return ret;
 
         /* Now get iPhone's answer */
-        ret = iphone_lckd_recv(control, &XML_content, &bytes);
+        ret = iphone_lckd_recv(control, &dict);
 
         if (ret != IPHONE_E_SUCCESS)
                 return ret;
 
-        plist = xmlReadMemory(XML_content, bytes, NULL, NULL, 0);
-        if (!plist)
-                return IPHONE_E_PLIST_ERROR;
-        dict = xmlDocGetRootElement(plist);
-        for (dict = dict->children; dict; dict = dict->next) {
-                if (!xmlStrcmp(dict->name, "dict"))
-                        break;
-        }
-        if (!dict)
-                return IPHONE_E_DICT_ERROR;
+        plist_t query_node = plist_find_node_by_string(dict, "GetValue");
+        plist_t result_key_node = plist_get_next_sibling(query_node);
+        plist_t result_value_node = plist_get_next_sibling(result_key_node);
 
-        /* Parse xml to check success and to find public key */
-        dictionary = read_dict_element_strings(dict);
-        xmlFreeDoc(plist);
-        free(XML_content);
+        plist_type result_key_type = plist_get_node_type(result_key_node);
+        plist_type result_value_type = plist_get_node_type(result_value_node);
 
-        int success = 0;
-        for (i = 0; dictionary[i]; i += 2) {
-                if (!strcmp(dictionary[i], "Result") && !strcmp(dictionary[i + 1], "Success")) {
-                        success = 1;
-                }
-                if (!strcmp(dictionary[i], "Value")) {
-                        *value = strdup(dictionary[i + 1]);
+        if (result_key_type == PLIST_KEY && result_value_type == PLIST_STRING) {
+
+                char *result_key = NULL;
+                char *result_value = NULL;
+                ret = IPHONE_E_DICT_ERROR;
+
+                plist_get_key_val(result_key_node, &result_key);
+                plist_get_string_val(result_value_node, &result_value);
+
+                if (!strcmp(result_key, "Result") && !strcmp(result_value, "Success")) {
+                        log_dbg_msg(DBGMASK_LOCKDOWND, "lockdownd_generic_get_value(): success\n");
+                        ret = IPHONE_E_SUCCESS;
                 }
+                free(result_key);
+                free(result_value);
+        }
+        if (ret != IPHONE_E_SUCCESS) {
+                return ret;
         }
 
-        if (dictionary) {
-                free_dictionary(dictionary);
-                dictionary = NULL;
+        plist_t value_key_node = plist_find_node_by_key(dict, "Value");//plist_get_next_sibling(result_value_node);
+        plist_t value_value_node = plist_get_next_sibling(value_key_node);
+
+        plist_type value_key_type = plist_get_node_type(value_key_node);
+
+        if (value_key_type == PLIST_KEY) {
+
+                char *result_key = NULL;
+                plist_get_key_val(value_key_node, &result_key);
+
+                if (!strcmp(result_key, "Value")) {
+                        log_dbg_msg(DBGMASK_LOCKDOWND, "lockdownd_generic_get_value(): success\n");
+
+                        plist_type value_value_type = plist_get_node_type(value_value_node);
+                        if (PLIST_STRING == value_value_type) {
+                                char *value_value = NULL;
+                                plist_get_string_val(value_value_node, &value_value);
+
+                                value->data = value_value;
+                                value->size = strlen(value_value);
+                                ret = IPHONE_E_SUCCESS;
+                        }
+
+                        if (PLIST_DATA == value_value_type) {
+                                char *value_value = NULL;
+                                uint64_t size = 0;
+                                plist_get_data_val(value_value_node, &value_value, &size);
+
+                                value->data = value_value;
+                                value->size = size;
+                                ret = IPHONE_E_SUCCESS;
+                        }
+                }
+                free(result_key);
         }
-        if (success)
-                ret = IPHONE_E_SUCCESS;
+
+        plist_free(dict);
         return ret;
 }
 
@@ -428,7 +445,10 @@ iphone_error_t lockdownd_generic_get_value(iphone_lckd_client_t control, const c
  */
 iphone_error_t lockdownd_get_device_uid(iphone_lckd_client_t control, char **uid)
 {
-        return lockdownd_generic_get_value(control, "Key", "UniqueDeviceID", uid);
+        gnutls_datum_t temp = { NULL, 0 };
+        iphone_error_t ret = lockdownd_generic_get_value(control, "Key", "UniqueDeviceID", &temp);
+        *uid = temp.data;
+        return ret;
 }
 
 /** Askes for the device's public key. Part of the lockdownd handshake.
@@ -437,7 +457,7 @@ iphone_error_t lockdownd_get_device_uid(iphone_lckd_client_t control, char **uid
  *
  * @return 1 on success and 0 on failure.
  */
-iphone_error_t lockdownd_get_device_public_key(iphone_lckd_client_t control, char **public_key)
+iphone_error_t lockdownd_get_device_public_key(iphone_lckd_client_t control, gnutls_datum_t * public_key)
 {
         return lockdownd_generic_get_value(control, "Key", "DevicePublicKey", public_key);
 }
@@ -472,6 +492,7 @@ iphone_error_t iphone_lckd_new_client(iphone_device_t device, iphone_lckd_client
         if (IPHONE_E_SUCCESS != ret) {
                 log_debug_msg("Device refused to send uid.\n");
         }
+        log_debug_msg("Device uid: %s\n", uid);
 
         host_id = get_host_id();
         if (IPHONE_E_SUCCESS == ret && !host_id) {
@@ -487,19 +508,22 @@ iphone_error_t iphone_lckd_new_client(iphone_device_t device, iphone_lckd_client
                 uid = NULL;
         }
 
-        ret = lockdownd_start_SSL_session(client_loc, host_id);
-        if (IPHONE_E_SUCCESS != ret) {
-                ret = IPHONE_E_SSL_ERROR;
-                log_debug_msg("SSL Session opening failed.\n");
-        }
+        if (IPHONE_E_SUCCESS == ret) {
+                ret = lockdownd_start_SSL_session(client_loc, host_id);
+                if (IPHONE_E_SUCCESS != ret) {
+                        ret = IPHONE_E_SSL_ERROR;
+                        log_debug_msg("SSL Session opening failed.\n");
+                }
+
+                if (host_id) {
+                        free(host_id);
+                        host_id = NULL;
+                }
 
-        if (host_id) {
-                free(host_id);
-                host_id = NULL;
+                if (IPHONE_E_SUCCESS == ret)
+                        *client = client_loc;
         }
 
-        if (IPHONE_E_SUCCESS == ret)
-                *client = client_loc;
         return ret;
 }
 
@@ -513,107 +537,92 @@ iphone_error_t iphone_lckd_new_client(iphone_device_t device, iphone_lckd_client
 iphone_error_t lockdownd_pair_device(iphone_lckd_client_t control, char *uid, char *host_id)
 {
         iphone_error_t ret = IPHONE_E_UNKNOWN_ERROR;
-        xmlDocPtr plist = new_plist();
-        xmlNode *dict = NULL;
-        xmlNode *dictRecord = NULL;
-        char **dictionary = NULL;
-        int bytes = 0, i = 0;
-        char *XML_content = NULL;
-        uint32 length = 0;
-
-        char *device_cert_b64 = NULL;
-        char *host_cert_b64 = NULL;
-        char *root_cert_b64 = NULL;
-        char *public_key_b64 = NULL;
-
-        ret = lockdownd_get_device_public_key(control, &public_key_b64);
+        plist_t dict = NULL;
+        plist_t dict_record = NULL;
+
+        gnutls_datum_t device_cert = { NULL, 0 };
+        gnutls_datum_t host_cert = { NULL, 0 };
+        gnutls_datum_t root_cert = { NULL, 0 };
+        gnutls_datum_t public_key = { NULL, 0 };
+
+        ret = lockdownd_get_device_public_key(control, &public_key);
         if (ret != IPHONE_E_SUCCESS) {
                 log_debug_msg("Device refused to send public key.\n");
                 return ret;
         }
+        log_debug_msg("device public key :\n %s.\n", public_key.data);
 
-        ret = lockdownd_gen_pair_cert(public_key_b64, &device_cert_b64, &host_cert_b64, &root_cert_b64);
+        ret = lockdownd_gen_pair_cert(public_key, &device_cert, &host_cert, &root_cert);
         if (ret != IPHONE_E_SUCCESS) {
-                free(public_key_b64);
+                free(public_key.data);
                 return ret;
         }
 
         /* Setup Pair request plist */
-        dict = add_child_to_plist(plist, "dict", "\n", NULL, 0);
-        dictRecord = add_key_dict_node(plist, dict, "PairRecord", "\n", 1);
-        //dictRecord = add_child_to_plist(plist, "dict", "\n", NULL, 1);
-        add_key_data_dict_element(plist, dictRecord, "DeviceCertificate", device_cert_b64, 2);
-        add_key_data_dict_element(plist, dictRecord, "HostCertificate", host_cert_b64, 2);
-        add_key_str_dict_element(plist, dictRecord, "HostID", host_id, 2);
-        add_key_data_dict_element(plist, dictRecord, "RootCertificate", root_cert_b64, 2);
-        add_key_str_dict_element(plist, dict, "Request", "Pair", 1);
-
-        xmlDocDumpMemory(plist, (xmlChar **) & XML_content, &length);
-
-        printf("XML Pairing request : %s\n", XML_content);
+        dict = plist_new_dict();
+        plist_add_sub_key_el(dict, "PairRecord");
+        dict_record = plist_new_dict();
+        plist_add_sub_node(dict, dict_record);
+        plist_add_sub_key_el(dict_record, "DeviceCertificate");
+        plist_add_sub_data_el(dict_record, (const char*)device_cert.data, device_cert.size);
+        plist_add_sub_key_el(dict_record, "HostCertificate");
+        plist_add_sub_data_el(dict_record, (const char*)host_cert.data, host_cert.size);
+        plist_add_sub_key_el(dict_record, "HostID");
+        plist_add_sub_string_el(dict_record, host_id);
+        plist_add_sub_key_el(dict_record, "RootCertificate");
+        plist_add_sub_data_el(dict_record, (const char*)root_cert.data, root_cert.size);
+        plist_add_sub_key_el(dict, "Request");
+        plist_add_sub_string_el(dict, "Pair");
 
         /* send to iPhone */
-        ret = iphone_lckd_send(control, XML_content, length, &bytes);
-
-        xmlFree(XML_content);
-        xmlFreeDoc(plist);
-        plist = NULL;
+        ret = iphone_lckd_send(control, dict);
+        plist_free(dict);
+        dict = NULL;
 
         if (ret != IPHONE_E_SUCCESS)
                 return ret;
 
         /* Now get iPhone's answer */
-        ret = iphone_lckd_recv(control, &XML_content, &bytes);
+        ret = iphone_lckd_recv(control, &dict);
 
         if (ret != IPHONE_E_SUCCESS)
                 return ret;
 
-        log_debug_msg("lockdown_pair_device: iPhone's response to our pair request:\n");
-        log_debug_msg(XML_content);
-        log_debug_msg("\n\n");
+        plist_t query_node = plist_find_node_by_string(dict, "Pair");
+        plist_t result_key_node = plist_get_next_sibling(query_node);
+        plist_t result_value_node = plist_get_next_sibling(result_key_node);
 
-        plist = xmlReadMemory(XML_content, bytes, NULL, NULL, 0);
-        if (!plist) {
-                free(public_key_b64);
-                return IPHONE_E_PLIST_ERROR;
-        }
-        dict = xmlDocGetRootElement(plist);
-        for (dict = dict->children; dict; dict = dict->next) {
-                if (!xmlStrcmp(dict->name, "dict"))
-                        break;
-        }
-        if (!dict) {
-                free(public_key_b64);
-                return IPHONE_E_DICT_ERROR;
-        }
+        plist_type result_key_type = plist_get_node_type(result_key_node);
+        plist_type result_value_type = plist_get_node_type(result_value_node);
 
-        /* Parse xml to check success and to find public key */
-        dictionary = read_dict_element_strings(dict);
-        xmlFreeDoc(plist);
-        free(XML_content);
+        if (result_key_type == PLIST_KEY && result_value_type == PLIST_STRING) {
 
-        int success = 0;
-        for (i = 0; dictionary[i]; i += 2) {
-                if (!strcmp(dictionary[i], "Result") && !strcmp(dictionary[i + 1], "Success")) {
-                        success = 1;
+                char *result_key = NULL;
+                char *result_value = NULL;
+
+                plist_get_key_val(result_key_node, &result_key);
+                plist_get_string_val(result_value_node, &result_value);
+
+                if (!strcmp(result_key, "Result") && !strcmp(result_value, "Success")) {
+                        ret = IPHONE_E_SUCCESS;
                 }
-        }
 
-        if (dictionary) {
-                free_dictionary(dictionary);
-                dictionary = NULL;
+                free(result_key);
+                free(result_value);
         }
+        plist_free(dict);
+        dict = NULL;
 
         /* store public key in config if pairing succeeded */
-        if (success) {
-                log_debug_msg("lockdownd_pair_device: pair success\n");
-                store_device_public_key(uid, public_key_b64);
+        if (ret == IPHONE_E_SUCCESS) {
+                log_dbg_msg(DBGMASK_LOCKDOWND, "lockdownd_pair_device: pair success\n");
+                store_device_public_key(uid, public_key);
                 ret = IPHONE_E_SUCCESS;
         } else {
-                log_debug_msg("lockdownd_pair_device: pair failure\n");
+                log_dbg_msg(DBGMASK_LOCKDOWND, "lockdownd_pair_device: pair failure\n");
                 ret = IPHONE_E_PAIRING_FAILED;
         }
-        free(public_key_b64);
+        free(public_key.data);
         return ret;
 }
 
@@ -626,81 +635,71 @@ iphone_error_t lockdownd_pair_device(iphone_lckd_client_t control, char *uid, ch
 void lockdownd_close(iphone_lckd_client_t control)
 {
         if (!control)
-                return;                                 // IPHONE_E_INVALID_ARG;
-        xmlDocPtr plist = new_plist();
-        xmlNode *dict, *key;
-        char **dictionary;
-        int bytes = 0, i = 0;
+                return;                                 //IPHONE_E_INVALID_ARG;
+
         iphone_error_t ret = IPHONE_E_UNKNOWN_ERROR;
 
-        log_debug_msg("lockdownd_close() called\n");
-        dict = add_child_to_plist(plist, "dict", "\n", NULL, 0);
-        key = add_key_str_dict_element(plist, dict, "Request", "Goodbye", 1);
-        char *XML_content;
-        uint32 length;
+        plist_t dict = plist_new_dict();
+        plist_add_sub_key_el(dict, "Request");
+        plist_add_sub_string_el(dict, "Goodbye");
 
-        xmlDocDumpMemory(plist, (xmlChar **) & XML_content, &length);
-        ret = iphone_lckd_send(control, XML_content, length, &bytes);
+        log_dbg_msg(DBGMASK_LOCKDOWND, "lockdownd_close() called\n");
 
-        xmlFree(XML_content);
-        xmlFreeDoc(plist);
-        plist = NULL;
-        ret = iphone_lckd_recv(control, &XML_content, &bytes);
+        ret = iphone_lckd_send(control, dict);
+        plist_free(dict);
+        dict = NULL;
+
+        ret = iphone_lckd_recv(control, &dict);
 
-        plist = xmlReadMemory(XML_content, bytes, NULL, NULL, 0);
-        if (!plist) {
-                log_debug_msg("lockdownd_close(): IPHONE_E_PLIST_ERROR\n");
-                return;                                 //IPHONE_E_PLIST_ERROR;
-        }
-        dict = xmlDocGetRootElement(plist);
-        for (dict = dict->children; dict; dict = dict->next) {
-                if (!xmlStrcmp(dict->name, "dict"))
-                        break;
-        }
         if (!dict) {
-                log_debug_msg("lockdownd_close(): IPHONE_E_DICT_ERROR\n");
-                return;                                 //IPHONE_E_DICT_ERROR;
+                log_dbg_msg(DBGMASK_LOCKDOWND, "lockdownd_close(): IPHONE_E_PLIST_ERROR\n");
+                return;                                 // IPHONE_E_PLIST_ERROR;
         }
-        dictionary = read_dict_element_strings(dict);
-        xmlFreeDoc(plist);
-        free(XML_content);
 
-        for (i = 0; dictionary[i]; i += 2) {
-                if (!strcmp(dictionary[i], "Result") && !strcmp(dictionary[i + 1], "Success")) {
-                        log_debug_msg("lockdownd_close(): success\n");
+        plist_t query_node = plist_find_node_by_string(dict, "Goodbye");
+        plist_t result_node = plist_get_next_sibling(query_node);
+        plist_t value_node = plist_get_next_sibling(result_node);
+
+        plist_type result_type = plist_get_node_type(result_node);
+        plist_type value_type = plist_get_node_type(value_node);
+
+        if (result_type == PLIST_KEY && value_type == PLIST_STRING) {
+                char *result_value = NULL;
+                char *value_value = NULL;
+
+                plist_get_key_val(result_node, &result_value);
+                plist_get_string_val(value_node, &value_value);
+
+                if (!strcmp(result_value, "Result") && !strcmp(value_value, "Success")) {
+                        log_dbg_msg(DBGMASK_LOCKDOWND, "lockdownd_close(): success\n");
                         ret = IPHONE_E_SUCCESS;
-                        break;
                 }
+                free(result_value);
+                free(value_value);
         }
-
-        free_dictionary(dictionary);
-        return;                                         //ret;
+        plist_free(dict);
+        dict = NULL;
+        return;                                         // ret;
 }
 
 /** Generates the device certificate from the public key as well as the host
  *  and root certificates.
- * 
+ *
  * @return IPHONE_E_SUCCESS on success.
  */
-iphone_error_t lockdownd_gen_pair_cert(char *public_key_b64, char **device_cert_b64, char **host_cert_b64,
-                                                                           char **root_cert_b64)
+iphone_error_t lockdownd_gen_pair_cert(gnutls_datum_t public_key, gnutls_datum_t * odevice_cert,
+                                                                           gnutls_datum_t * ohost_cert, gnutls_datum_t * oroot_cert)
 {
-        if (!public_key_b64 || !device_cert_b64 || !host_cert_b64 || !root_cert_b64)
+        if (!public_key.data || !odevice_cert || !ohost_cert || !oroot_cert)
                 return IPHONE_E_INVALID_ARG;
         iphone_error_t ret = IPHONE_E_UNKNOWN_ERROR;
 
         gnutls_datum_t modulus = { NULL, 0 };
         gnutls_datum_t exponent = { NULL, 0 };
 
-        /* first decode base64 public_key */
-        gnutls_datum_t pem_pub_key;
-        gsize decoded_size;
-        pem_pub_key.data = g_base64_decode(public_key_b64, &decoded_size);
-        pem_pub_key.size = decoded_size;
-
         /* now decode the PEM encoded key */
         gnutls_datum_t der_pub_key;
-        if (GNUTLS_E_SUCCESS == gnutls_pem_base64_decode_alloc("RSA PUBLIC KEY", &pem_pub_key, &der_pub_key)) {
+        if (GNUTLS_E_SUCCESS == gnutls_pem_base64_decode_alloc("RSA PUBLIC KEY", &public_key, &der_pub_key)) {
 
                 /* initalize asn.1 parser */
                 ASN1_TYPE pkcs1 = ASN1_TYPE_EMPTY;
@@ -736,7 +735,7 @@ iphone_error_t lockdownd_gen_pair_cert(char *public_key_b64, char **device_cert_
                 gnutls_global_init();
                 gnutls_datum_t essentially_null = { strdup("abababababababab"), strlen("abababababababab") };
 
-                gnutls_x509_privkey_t fake_privkey, root_privkey;
+                gnutls_x509_privkey_t fake_privkey, root_privkey, host_privkey;
                 gnutls_x509_crt_t dev_cert, root_cert, host_cert;
 
                 gnutls_x509_privkey_init(&fake_privkey);
@@ -749,49 +748,50 @@ iphone_error_t lockdownd_gen_pair_cert(char *public_key_b64, char **device_cert_
                                                                                            &essentially_null, &essentially_null)) {
 
                         gnutls_x509_privkey_init(&root_privkey);
+                        gnutls_x509_privkey_init(&host_privkey);
 
-                        /* get root cert */
-                        gnutls_datum_t pem_root_cert = { NULL, 0 };
-                        get_root_certificate(&pem_root_cert);
-                        if (GNUTLS_E_SUCCESS != gnutls_x509_crt_import(root_cert, &pem_root_cert, GNUTLS_X509_FMT_PEM))
-                                ret = IPHONE_E_SSL_ERROR;
-
-                        /* get host cert */
-                        gnutls_datum_t pem_host_cert = { NULL, 0 };
-                        get_host_certificate(&pem_host_cert);
-                        if (GNUTLS_E_SUCCESS != gnutls_x509_crt_import(host_cert, &pem_host_cert, GNUTLS_X509_FMT_PEM))
-                                ret = IPHONE_E_SSL_ERROR;
-
-                        /* get root private key */
-                        gnutls_datum_t pem_root_priv = { NULL, 0 };
-                        get_root_private_key(&pem_root_priv);
-                        if (GNUTLS_E_SUCCESS != gnutls_x509_privkey_import(root_privkey, &pem_root_priv, GNUTLS_X509_FMT_PEM))
-                                ret = IPHONE_E_SSL_ERROR;
-
-                        /* generate device certificate */
-                        gnutls_x509_crt_set_key(dev_cert, fake_privkey);
-                        gnutls_x509_crt_set_serial(dev_cert, "\x00", 1);
-                        gnutls_x509_crt_set_version(dev_cert, 3);
-                        gnutls_x509_crt_set_ca_status(dev_cert, 0);
-                        gnutls_x509_crt_set_activation_time(dev_cert, time(NULL));
-                        gnutls_x509_crt_set_expiration_time(dev_cert, time(NULL) + (60 * 60 * 24 * 365 * 10));
-                        gnutls_x509_crt_sign(dev_cert, root_cert, root_privkey);
+                        ret = get_keys_and_certs( root_privkey, root_cert, host_privkey, host_cert);
 
                         if (IPHONE_E_SUCCESS == ret) {
-                                /* if everything went well, export in PEM format */
-                                gnutls_datum_t dev_pem = { NULL, 0 };
-                                gnutls_x509_crt_export(dev_cert, GNUTLS_X509_FMT_PEM, NULL, &dev_pem.size);
-                                dev_pem.data = gnutls_malloc(dev_pem.size);
-                                gnutls_x509_crt_export(dev_cert, GNUTLS_X509_FMT_PEM, dev_pem.data, &dev_pem.size);
-
-                                /* now encode certificates for output */
-                                *device_cert_b64 = g_base64_encode(dev_pem.data, dev_pem.size);
-                                *host_cert_b64 = g_base64_encode(pem_host_cert.data, pem_host_cert.size);
-                                *root_cert_b64 = g_base64_encode(pem_root_cert.data, pem_root_cert.size);
+
+                                /* generate device certificate */
+                                gnutls_x509_crt_set_key(dev_cert, fake_privkey);
+                                gnutls_x509_crt_set_serial(dev_cert, "\x00", 1);
+                                gnutls_x509_crt_set_version(dev_cert, 3);
+                                gnutls_x509_crt_set_ca_status(dev_cert, 0);
+                                gnutls_x509_crt_set_activation_time(dev_cert, time(NULL));
+                                gnutls_x509_crt_set_expiration_time(dev_cert, time(NULL) + (60 * 60 * 24 * 365 * 10));
+                                gnutls_x509_crt_sign(dev_cert, root_cert, root_privkey);
+
+                                if (IPHONE_E_SUCCESS == ret) {
+                                        /* if everything went well, export in PEM format */
+                                        gnutls_datum_t dev_pem = { NULL, 0 };
+                                        gnutls_x509_crt_export(dev_cert, GNUTLS_X509_FMT_PEM, NULL, &dev_pem.size);
+                                        dev_pem.data = gnutls_malloc(dev_pem.size);
+                                        gnutls_x509_crt_export(dev_cert, GNUTLS_X509_FMT_PEM, dev_pem.data, &dev_pem.size);
+
+                                        gnutls_datum_t pem_root_cert = { NULL, 0 };
+                                        gnutls_datum_t pem_host_cert = { NULL, 0 };
+
+                                        if ( IPHONE_E_SUCCESS ==  get_certs_as_pem(&pem_root_cert, &pem_host_cert) ) {
+                                                /* copy buffer for output */
+                                                odevice_cert->data = malloc(dev_pem.size);
+                                                memcpy(odevice_cert->data, dev_pem.data, dev_pem.size);
+                                                odevice_cert->size = dev_pem.size;
+
+                                                ohost_cert->data = malloc(pem_host_cert.size);
+                                                memcpy(ohost_cert->data, pem_host_cert.data, pem_host_cert.size);
+                                                ohost_cert->size = pem_host_cert.size;
+
+                                                oroot_cert->data = malloc(pem_root_cert.size);
+                                                memcpy(oroot_cert->data, pem_root_cert.data, pem_root_cert.size);
+                                                oroot_cert->size = pem_root_cert.size;
+
+                                                g_free(pem_root_cert.data);
+                                                g_free(pem_host_cert.data);
+                                        }
+                                }
                         }
-                        gnutls_free(pem_root_priv.data);
-                        gnutls_free(pem_root_cert.data);
-                        gnutls_free(pem_host_cert.data);
                 }
         }
 
@@ -799,7 +799,6 @@ iphone_error_t lockdownd_gen_pair_cert(char *public_key_b64, char **device_cert_
         gnutls_free(exponent.data);
 
         gnutls_free(der_pub_key.data);
-        g_free(pem_pub_key.data);
 
         return ret;
 }
@@ -813,129 +812,127 @@ iphone_error_t lockdownd_gen_pair_cert(char *public_key_b64, char **device_cert_
  */
 iphone_error_t lockdownd_start_SSL_session(iphone_lckd_client_t control, const char *HostID)
 {
-        xmlDocPtr plist = new_plist();
-        xmlNode *dict = add_child_to_plist(plist, "dict", "\n", NULL, 0);
-        xmlNode *key;
-        char *what2send = NULL, **dictionary = NULL;
-        uint32 len = 0, bytes = 0, return_me = 0, i = 0;
-        iphone_error_t ret = IPHONE_E_UNKNOWN_ERROR;
-        // end variables
+        plist_t dict = NULL;
+        uint32_t return_me = 0;
 
+        iphone_error_t ret = IPHONE_E_UNKNOWN_ERROR;
         control->session_id[0] = '\0';
 
-        key = add_key_str_dict_element(plist, dict, "HostID", HostID, 1);
-        if (!key) {
-                log_debug_msg("Couldn't add a key.\n");
-                xmlFreeDoc(plist);
-                return IPHONE_E_DICT_ERROR;
-        }
-        key = add_key_str_dict_element(plist, dict, "Request", "StartSession", 1);
-        if (!key) {
-                log_debug_msg("Couldn't add a key.\n");
-                xmlFreeDoc(plist);
-                return IPHONE_E_DICT_ERROR;
-        }
-
-        xmlDocDumpMemory(plist, (xmlChar **) & what2send, &len);
-        ret = iphone_lckd_send(control, what2send, len, &bytes);
+        /* Setup DevicePublicKey request plist */
+        dict = plist_new_dict();
+        plist_add_sub_key_el(dict, "HostID");
+        plist_add_sub_string_el(dict, HostID);
+        plist_add_sub_key_el(dict, "Request");
+        plist_add_sub_string_el(dict, "StartSession");
 
-        xmlFree(what2send);
-        xmlFreeDoc(plist);
+        ret = iphone_lckd_send(control, dict);
+        plist_free(dict);
+        dict = NULL;
 
         if (ret != IPHONE_E_SUCCESS)
                 return ret;
 
-        if (bytes > 0) {
-                ret = iphone_lckd_recv(control, &what2send, &len);
-                plist = xmlReadMemory(what2send, len, NULL, NULL, 0);
-                dict = xmlDocGetRootElement(plist);
-                if (!dict)
-                        return IPHONE_E_DICT_ERROR;
-                for (dict = dict->children; dict; dict = dict->next) {
-                        if (!xmlStrcmp(dict->name, "dict"))
-                                break;
-                }
-                dictionary = read_dict_element_strings(dict);
-                xmlFreeDoc(plist);
-                free(what2send);
+        ret = iphone_lckd_recv(control, &dict);
+
+        if (!dict)
+                return IPHONE_E_PLIST_ERROR;
+
+        plist_t query_node = plist_find_node_by_string(dict, "StartSession");
+        plist_t result_key_node = plist_get_next_sibling(query_node);
+        plist_t result_value_node = plist_get_next_sibling(result_key_node);
+
+        plist_type result_key_type = plist_get_node_type(result_key_node);
+        plist_type result_value_type = plist_get_node_type(result_value_node);
+
+        if (result_key_type == PLIST_KEY && result_value_type == PLIST_STRING) {
+                char *result_key = NULL;
+                char *result_value = NULL;
+
+                plist_get_key_val(result_key_node, &result_key);
+                plist_get_string_val(result_value_node, &result_value);
+
                 ret = IPHONE_E_SSL_ERROR;
-                for (i = 0; dictionary[i]; i += 2) {
-                        if (!strcmp(dictionary[i], "Result") && !strcmp(dictionary[i + 1], "Success")) {
-                                // Set up GnuTLS...
-                                //gnutls_anon_client_credentials_t anoncred;
-                                gnutls_certificate_credentials_t xcred;
-
-                                log_debug_msg("We started the session OK, now trying GnuTLS\n");
-                                errno = 0;
-                                gnutls_global_init();
-                                //gnutls_anon_allocate_client_credentials(&anoncred);
-                                gnutls_certificate_allocate_credentials(&xcred);
-                                gnutls_certificate_set_x509_trust_file(xcred, "hostcert.pem", GNUTLS_X509_FMT_PEM);
-                                gnutls_init(control->ssl_session, GNUTLS_CLIENT);
-                                {
-                                        int protocol_priority[16] = { GNUTLS_SSL3, 0 };
-                                        int kx_priority[16] = { GNUTLS_KX_ANON_DH, GNUTLS_KX_RSA, 0 };
-                                        int cipher_priority[16] = { GNUTLS_CIPHER_AES_128_CBC, GNUTLS_CIPHER_AES_256_CBC, 0 };
-                                        int mac_priority[16] = { GNUTLS_MAC_SHA1, GNUTLS_MAC_MD5, 0 };
-                                        int comp_priority[16] = { GNUTLS_COMP_NULL, 0 };
-
-                                        gnutls_cipher_set_priority(*control->ssl_session, cipher_priority);
-                                        gnutls_compression_set_priority(*control->ssl_session, comp_priority);
-                                        gnutls_kx_set_priority(*control->ssl_session, kx_priority);
-                                        gnutls_protocol_set_priority(*control->ssl_session, protocol_priority);
-                                        gnutls_mac_set_priority(*control->ssl_session, mac_priority);
+                if (!strcmp(result_key, "Result") && !strcmp(result_value, "Success")) {
+                        // Set up GnuTLS...
+                        //gnutls_anon_client_credentials_t anoncred;
+                        gnutls_certificate_credentials_t xcred;
+
+                        log_dbg_msg(DBGMASK_LOCKDOWND, "We started the session OK, now trying GnuTLS\n");
+                        errno = 0;
+                        gnutls_global_init();
+                        //gnutls_anon_allocate_client_credentials(&anoncred);
+                        gnutls_certificate_allocate_credentials(&xcred);
+                        gnutls_certificate_set_x509_trust_file(xcred, "hostcert.pem", GNUTLS_X509_FMT_PEM);
+                        gnutls_init(control->ssl_session, GNUTLS_CLIENT);
+                        {
+                                int protocol_priority[16] = { GNUTLS_SSL3, 0 };
+                                int kx_priority[16] = { GNUTLS_KX_ANON_DH, GNUTLS_KX_RSA, 0 };
+                                int cipher_priority[16] = { GNUTLS_CIPHER_AES_128_CBC, GNUTLS_CIPHER_AES_256_CBC, 0 };
+                                int mac_priority[16] = { GNUTLS_MAC_SHA1, GNUTLS_MAC_MD5, 0 };
+                                int comp_priority[16] = { GNUTLS_COMP_NULL, 0 };
+
+                                gnutls_cipher_set_priority(*control->ssl_session, cipher_priority);
+                                gnutls_compression_set_priority(*control->ssl_session, comp_priority);
+                                gnutls_kx_set_priority(*control->ssl_session, kx_priority);
+                                gnutls_protocol_set_priority(*control->ssl_session, protocol_priority);
+                                gnutls_mac_set_priority(*control->ssl_session, mac_priority);
 
-                                }
-                                gnutls_credentials_set(*control->ssl_session, GNUTLS_CRD_CERTIFICATE, xcred);   // this part is killing me.
-
-                                log_debug_msg("GnuTLS step 1...\n");
-                                gnutls_transport_set_ptr(*control->ssl_session, (gnutls_transport_ptr_t) control);
-                                log_debug_msg("GnuTLS step 2...\n");
-                                gnutls_transport_set_push_function(*control->ssl_session, (gnutls_push_func) & lockdownd_secuwrite);
-                                log_debug_msg("GnuTLS step 3...\n");
-                                gnutls_transport_set_pull_function(*control->ssl_session, (gnutls_pull_func) & lockdownd_securead);
-                                log_debug_msg("GnuTLS step 4 -- now handshaking...\n");
-
-                                if (errno)
-                                        log_debug_msg("WARN: errno says %s before handshake!\n", strerror(errno));
-                                return_me = gnutls_handshake(*control->ssl_session);
-                                log_debug_msg("GnuTLS handshake done...\n");
-
-                                if (return_me != GNUTLS_E_SUCCESS) {
-                                        log_debug_msg("GnuTLS reported something wrong.\n");
-                                        gnutls_perror(return_me);
-                                        log_debug_msg("oh.. errno says %s\n", strerror(errno));
-                                        return IPHONE_E_SSL_ERROR;
-                                } else {
-                                        control->in_SSL = 1;
-                                        ret = IPHONE_E_SUCCESS;
-                                }
-                        } else if (!strcmp(dictionary[i], "SessionID")) {
-                                // we need to store the session ID for StopSession
-                                strcpy(control->session_id, dictionary[i + 1]);
-                                log_debug_msg("SessionID: %s\n", control->session_id);
-                                free_dictionary(dictionary);
-                                return ret;
+                        }
+                        gnutls_credentials_set(*control->ssl_session, GNUTLS_CRD_CERTIFICATE, xcred);   // this part is killing me.
+
+                        log_dbg_msg(DBGMASK_LOCKDOWND, "GnuTLS step 1...\n");
+                        gnutls_transport_set_ptr(*control->ssl_session, (gnutls_transport_ptr_t) control);
+                        log_dbg_msg(DBGMASK_LOCKDOWND, "GnuTLS step 2...\n");
+                        gnutls_transport_set_push_function(*control->ssl_session, (gnutls_push_func) & lockdownd_secuwrite);
+                        log_dbg_msg(DBGMASK_LOCKDOWND, "GnuTLS step 3...\n");
+                        gnutls_transport_set_pull_function(*control->ssl_session, (gnutls_pull_func) & lockdownd_securead);
+                        log_dbg_msg(DBGMASK_LOCKDOWND, "GnuTLS step 4 -- now handshaking...\n");
+
+                        if (errno)
+                                log_dbg_msg(DBGMASK_LOCKDOWND, "WARN: errno says %s before handshake!\n", strerror(errno));
+                        return_me = gnutls_handshake(*control->ssl_session);
+                        log_dbg_msg(DBGMASK_LOCKDOWND, "GnuTLS handshake done...\n");
+
+                        if (return_me != GNUTLS_E_SUCCESS) {
+                                log_dbg_msg(DBGMASK_LOCKDOWND, "GnuTLS reported something wrong.\n");
+                                gnutls_perror(return_me);
+                                log_dbg_msg(DBGMASK_LOCKDOWND, "oh.. errno says %s\n", strerror(errno));
+                                return IPHONE_E_SSL_ERROR;
+                        } else {
+                                control->in_SSL = 1;
+                                ret = IPHONE_E_SUCCESS;
                         }
                 }
-                if (ret == IPHONE_E_SUCCESS) {
-                        log_debug_msg("Failed to get SessionID!\n");
-                        return ret;
-                }
+        }
+        //store session id
+        plist_t session_node = plist_find_node_by_key(dict, "SessionID");
+        if (session_node) {
+
+                plist_t session_node_val = plist_get_next_sibling(session_node);
+                plist_type session_node_val_type = plist_get_node_type(session_node_val);
+
+                if (session_node_val_type == PLIST_STRING) {
 
-                log_debug_msg("Apparently failed negotiating with lockdownd.\n");
-                log_debug_msg("Responding dictionary: \n");
-                for (i = 0; dictionary[i]; i += 2) {
-                        log_debug_msg("\t%s: %s\n", dictionary[i], dictionary[i + 1]);
+                        char *session_id = NULL;
+                        plist_get_string_val(session_node_val, &session_id);
+
+                        if (session_node_val_type == PLIST_STRING && session_id) {
+                                // we need to store the session ID for StopSession
+                                strcpy(control->session_id, session_id);
+                                log_dbg_msg(DBGMASK_LOCKDOWND, "SessionID: %s\n", control->session_id);
+                        }
+                        free(session_id);
                 }
+        } else
+                log_dbg_msg(DBGMASK_LOCKDOWND, "Failed to get SessionID!\n");
+        plist_free(dict);
+        dict = NULL;
 
+        if (ret == IPHONE_E_SUCCESS)
+                return ret;
 
-                free_dictionary(dictionary);
-                return IPHONE_E_SSL_ERROR;
-        } else {
-                log_debug_msg("Didn't get enough bytes.\n");
-                return IPHONE_E_NOT_ENOUGH_DATA;
-        }
+        log_dbg_msg(DBGMASK_LOCKDOWND, "Apparently failed negotiating with lockdownd.\n");
+        return IPHONE_E_SSL_ERROR;
 }
 
 /** gnutls callback for writing data to the iPhone.
@@ -951,10 +948,10 @@ ssize_t lockdownd_secuwrite(gnutls_transport_ptr_t transport, char *buffer, size
         int bytes = 0;
         iphone_lckd_client_t control;
         control = (iphone_lckd_client_t) transport;
-        log_debug_msg("lockdownd_secuwrite() called\n");
-        log_debug_msg("pre-send\nlength = %zi\n", length);
+        log_dbg_msg(DBGMASK_LOCKDOWND, "lockdownd_secuwrite() called\n");
+        log_dbg_msg(DBGMASK_LOCKDOWND, "pre-send\nlength = %zi\n", length);
         iphone_mux_send(control->connection, buffer, length, &bytes);
-        log_debug_msg("post-send\nsent %i bytes\n", bytes);
+        log_dbg_msg(DBGMASK_LOCKDOWND, "post-send\nsent %i bytes\n", bytes);
 
         dump_debug_buffer("sslpacketwrite.out", buffer, length);
         return bytes;
@@ -1038,86 +1035,72 @@ iphone_error_t iphone_lckd_start_service(iphone_lckd_client_t client, const char
         if (!client->in_SSL && !lockdownd_start_SSL_session(client, host_id))
                 return IPHONE_E_SSL_ERROR;
 
-        char *XML_query, **dictionary;
-        uint32 length, i = 0, port_loc = 0, bytes = 0;
-        uint8 result = 0;
+        plist_t dict = NULL;
+        uint32_t port_loc = 0;
         iphone_error_t ret = IPHONE_E_UNKNOWN_ERROR;
 
         free(host_id);
         host_id = NULL;
 
-        xmlDocPtr plist = new_plist();
-        xmlNode *dict = add_child_to_plist(plist, "dict", "\n", NULL, 0);
-        xmlNode *key;
-        key = add_key_str_dict_element(plist, dict, "Request", "StartService", 1);
-        if (!key) {
-                xmlFreeDoc(plist);
-                return IPHONE_E_UNKNOWN_ERROR;
-        }
-        key = add_key_str_dict_element(plist, dict, "Service", service, 1);
-        if (!key) {
-                xmlFreeDoc(plist);
-                return IPHONE_E_UNKNOWN_ERROR;
-        }
+        dict = plist_new_dict();
+        plist_add_sub_key_el(dict, "Request");
+        plist_add_sub_string_el(dict, "StartService");
+        plist_add_sub_key_el(dict, "Service");
+        plist_add_sub_string_el(dict, service);
 
-        xmlDocDumpMemory(plist, (xmlChar **) & XML_query, &length);
+        /* send to iPhone */
+        ret = iphone_lckd_send(client, dict);
+        plist_free(dict);
+        dict = NULL;
 
-        ret = iphone_lckd_send(client, XML_query, length, &bytes);
-        free(XML_query);
         if (IPHONE_E_SUCCESS != ret)
                 return ret;
 
-        ret = iphone_lckd_recv(client, &XML_query, &bytes);
-        xmlFreeDoc(plist);
+        ret = iphone_lckd_recv(client, &dict);
+
         if (IPHONE_E_SUCCESS != ret)
                 return ret;
 
-        if (bytes <= 0)
-                return IPHONE_E_NOT_ENOUGH_DATA;
-        else {
-                plist = xmlReadMemory(XML_query, bytes, NULL, NULL, 0);
-                if (!plist)
-                        return IPHONE_E_UNKNOWN_ERROR;
-                dict = xmlDocGetRootElement(plist);
-                if (!dict)
-                        return IPHONE_E_UNKNOWN_ERROR;
-                for (dict = dict->children; dict; dict = dict->next) {
-                        if (!xmlStrcmp(dict->name, "dict"))
-                                break;
-                }
+        if (!dict)
+                return IPHONE_E_PLIST_ERROR;
 
-                if (!dict)
-                        return IPHONE_E_UNKNOWN_ERROR;
-                dictionary = read_dict_element_strings(dict);
+        plist_t query_node = plist_find_node_by_string(dict, "StartService");
+        plist_t result_key_node = plist_get_next_sibling(query_node);
+        plist_t result_value_node = plist_get_next_sibling(result_key_node);
 
-                for (i = 0; dictionary[i]; i += 2) {
-                        log_debug_msg("lockdownd_start_service() dictionary %s: %s\n", dictionary[i], dictionary[i + 1]);
+        plist_t port_key_node = plist_find_node_by_key(dict, "Port");
+        plist_t port_value_node = plist_get_next_sibling(port_key_node);
 
-                        if (!xmlStrcmp(dictionary[i], "Port")) {
-                                port_loc = atoi(dictionary[i + 1]);
-                                log_debug_msg("lockdownd_start_service() atoi'd port: %i\n", port);
-                        }
+        plist_type result_key_type = plist_get_node_type(result_key_node);
+        plist_type result_value_type = plist_get_node_type(result_value_node);
+        plist_type port_key_type = plist_get_node_type(port_key_node);
+        plist_type port_value_type = plist_get_node_type(port_value_node);
 
-                        if (!xmlStrcmp(dictionary[i], "Result")) {
-                                if (!xmlStrcmp(dictionary[i + 1], "Success")) {
-                                        result = 1;
-                                }
-                        }
-                }
+        if (result_key_type == PLIST_KEY && result_value_type == PLIST_STRING && port_key_type == PLIST_KEY
+                && port_value_type == PLIST_UINT) {
 
-                log_debug_msg("lockdownd_start_service(): DATA RECEIVED:\n\n");
-                log_debug_msg(XML_query);
-                log_debug_msg("end data received by lockdownd_start_service()\n");
+                char *result_key = NULL;
+                char *result_value = NULL;
+                char *port_key = NULL;
+                uint64_t port_value = 0;
 
-                free(XML_query);
-                xmlFreeDoc(plist);
-                free_dictionary(dictionary);
-                if (port && result) {
+                plist_get_key_val(result_key_node, &result_key);
+                plist_get_string_val(result_value_node, &result_value);
+                plist_get_key_val(port_key_node, &port_key);
+                plist_get_uint_val(port_value_node, &port_value);
+
+                if (!strcmp(result_key, "Result") && !strcmp(result_value, "Success") && !strcmp(port_key, "Port")) {
+                        port_loc = port_value;
+                        ret = IPHONE_E_SUCCESS;
+                }
+
+                if (port && ret == IPHONE_E_SUCCESS)
                         *port = port_loc;
-                        return IPHONE_E_SUCCESS;
-                } else
-                        return IPHONE_E_UNKNOWN_ERROR;
+                else
+                        ret = IPHONE_E_UNKNOWN_ERROR;
         }
 
-        return IPHONE_E_UNKNOWN_ERROR;
+        plist_free(dict);
+        dict = NULL;
+        return ret;
 }