Reverse-Engineering Apple's Find My Friends API on Linux

A developer set out to build a simple Linux automation that would post Discord alerts when a friend—who had consented to share his location—entered or left certain geofences. What started as a quick evening project turned into a deep reverse-engineering effort against Apple's undocumented Find My Friends API, since no prior open-source implementation fully covered it.

Without access to a Mac, the work relied on existing open-source Find My clients and decompilations of Apple's fmfd, findmylocated, and searchpartyd daemons. The investigation traced the legacy MobileMe token system to find the correct authentication token (mmeFMFAppToken, searchPartyToken, etc.) needed for the old friends/fmfd initClient call, which reveals accepted location shares but not the actual coordinates or decryption keys.

Getting real location data required registering the client as a genuine IDS (Identity Services) device: authenticating through Apple's GrandSlam protocol with SRP and two-factor authentication, then generating 'anisette' headers that impersonate a provisioned Apple device to APNs. The share turned out to use Apple's newer encrypted location path (secureLocationsCapable), meaning the relationship was easy to discover but the underlying keys and location payloads remained a much harder unlock.

For engineers, this is a rare, detailed walkthrough of how MobileMe, IDS, and APNs interlock inside Apple's private protocols—useful reference material for anyone building third-party Find My clients or studying Apple's device-identity infrastructure.