Taking a Bite at Apple's Network Stack: Reversing Proprietary Multi-Device Protocols with logfuse

Apple’s walled garden consists of various proprietary network protocols. One of them is Low-Latency WiFi (LLW), which enables real-time applications like Sidecar Display or Continuity Camera. This talk walks through how the internals of Low-Latency WiFi were reverse engineered. Alongside that, we publish logfuse, a toolkit combining log information from different devices into a single timeline.

Reverse engineering proprietary network protocols means dealing with information scattered across log files, kernel traces, and network captures, often generated across multiple devices. Correlating events in these sources has been cumbersome and manual work, although their dependencies often make protocol analysis more conclusive.

This talk presents the reverse engineering process of Low-Latency WiFi (LLW), Apple’s proprietary link-layer protocol for real-time applications such as Sidecar Display and Continuity Camera, which has remained undocumented in prior reverse engineering of Apple’s ecosystem. We walk through how correlating kernel traces, network captures, and system logs across iOS and macOS devices revealed LLW’s internals. Alongside this, we publish logfuse, an open-source toolkit that made LLW’s internals accessible by aggregating heterogeneous traces from iOS and macOS into a single clock-aligned timeline.