Analysis of Excessive Data Consumption and App Crashing on iOS Devices

索引
[隐藏]

点击这里前往中文版/Click here for Chinese version

This is the third knotty issue happened on my Apple devices.

By the end of June this year, my iPhone running iOS11.4 ran nearly 10G of mobile data during a single day. The log of Shadowrocket(An Network Extension app) revealed that my iPhone kept downloading unknown data from gateway.icloud.com at the rate of about 200kb/s. I tried switching the iCloud account, but the problem appeared again after a short period of time. I was busy dealing with the exams at that time, so I simply Rejected gateway.icloud.com in Shadowrocket. No negative influence on daily use.

After some searching, I found some people claimed they have encountered a similar problems (22nd floor): https://www.v2ex.com/t/459452 . However, his solution of logging out of iCloud on macOS devices was not successful for me.

But the trouble didn’t end. Since then, a large number of apps crashes while launching on my iPhone and iPad at a frequency of 2-3 times a week. When the problem occurs, most applications will hang at the Splash Screen and crash after about 10 seconds. Applications that crashed including TIM, Notability and all of the Google apps. WeChat and Apple’s own applications are unaffected. During this time, the phone went hot, and will stuck when entering the iCloud settings. My iPhone runs iOS 11.4 and 12 Public Beta, and iPad running 11.4 and 12 Developer Beta.

Attempts

I tried rebooting, force rebooting, reinstalling affected apps, upgrading iOS, logging out and logging back in to iCloud, didn’t work. A temporary solution is turning the iCloud Drive switch off and on, which has a chance to temporarily fix the problem. However, entering the iCloud settings at this time has a high probability of being stuck, so you need to try several times. The iPhone will recover from the problem after a while even if not doing anything.

Analysis

Because this problem is very subtle, each person’s description varies, thus difficult to search online. Here is a collection of posts and threads complaining about the issue.
https://www.v2ex.com/t/460089
https://www.v2ex.com/t/471491
https://cn0xroot.com/2018/07/17/2018-07-16/
https://www.v2ex.com/t/459452
https://discussionschinese.apple.com/thread/140132632
https://www.reddit.com/r/jailbreak/comments/8sf4u3/help_this_block_of_text_is_being_spammed_in_my/
https://forums.developer.apple.com/thread/105722
https://forums.macrumors.com/threads/excessive-data-consumption-for-documents-sync-and-constantly-high-cpu-load-on-iphone-and-ipad.2127349/

The problem happens randomly. I have no idea how it is triggered thus no way to reproduce it manually. Considering toggling the iCloud Drive have a chance to temporarily fix this problem, I figured the problem is related to iCloud. As for the iCloud continuous download data problem that has appeared before, I guess there is a correlation between the two issues.

The console revealed that Provision violated for watchdog scene - create message shows in the console when an app launches and crashes.This error message is caused by app forcibly killed by the system due to the long startup time.

Meanwhile, while the problem happens, a large number of the following logs appears in the console, up to dozens per second. (The log is very long, please slide to the right)

Through the com.apple.ProtectedCloudStorage in the log, I preliminarily targeted that the issue appears in the Keychain. But I have no idea what Manatee is after not finding valuable information on the search engine.

I found a thread on Reddit by searching the contents of the log:

[Help] This block of text is being spammed in my system logs hundreds of times every 10 seconds. Details inside : jailbreak

The author nhcoil and I encountered almost the same problem. I sent a private message and I got the following reply:

Never found the solution. Brought my phone in multiple times and nothing, even got a replacement device and the issue persisted. The problem was something in my iCloud. I don’t know what, didn’t have anything in there at all.
Holy solution was creating a new iCloud account and not carrying anything over and manually putting everything like contacts etc.
I’m sorry I can’t be much help, I spoke with Apple live chat about the issue and gave everything I could to isolate and help with the problem.
If you do find a solution other than a new iCloud account, then that’s amazing but for now I think that’s all that can be done.
Regards,
Micheal

Studying the logs above and the information provided by nhcoil, I inferred that the problem is caused by some problems in the data in iCloud, resulting in unexpected synchronization errors, and the problem is likely to appear in the Keychain.

Then I searched for this thread

iCloud Keychain database grows when 2-factor en… |Apple Developer Forums

More information is provided:

This process will continue writing around 30000 lines to the database, and during this time, secd uses 100%+ of a CPU. Once that’s finished, I can manually edit the database using an Sqlite editor, which brings the database down to around 10-15MB, and Safari passwords will resume working. Eventually the database will grow again and Keychain stops working.
Signing all devices out of iCloud Keychain does not clear this problem. Computers running 10.11.6 and 10.12.6 work normally, so the problem seems to stem from some new feature in iOS 11 and macOS 10.13.

I went to the local Keychain database on my MacBook, and I found tons of data containing Manatee , up to tens thousands of lines, and these data will not be displayed in Keychain Access.

I believe there are similar data in my iCloud Keychain, but I have no way to view or delete it.

Continuing the search, I found another thread on MacRumors:

Excessive data consumption for “Documents & Sync” and constantly high CPU load on iPhone and iPad | MacRumors Forums

From the information provided in the thread, we can determine that the problem is indeed in the Keychain.
Moreover, both of these threads mentioned that when 2-factor authentication is disabled, the problem will not happen again, and it can be regarded as a relatively feasible solution.

In conclusion, I suppose the reason of the issue is after enabling 2-factor authentication on macOS devices, a bug in a module called Manatee caused a large amount of flawed data generated and uploaded to iCloud Keychain. During downloading and processing these huge amounts of data, iOS devices cause a lot of traffic consumption and App crash

Solutions

Solution1:Reset CloudKit

The solution have been confirmed valid.

User XXL pointed out in the comments that there is a new solution in this thread, and the 22nd floor provides several commands for resetting CloudKit. These commands are only valid when 2-factor authentication is enabled. Please ensure that 2-factor authentication is enabled before operation. Although the data will not be lost in theory, please backup the health and keychain data in advance for the sake of safety.

Login to the problematic iCloud account on macOS device, check the size of ~/Library/Keychains/(UUID)/keychain-2.db. Its size may be up to hundreds of MB, even bigger than 1GB.

Check the CloudKit status

Continue if the CloudKit status is logged in on every view. Turning off the 2-factor authentication may cause the CloudKit status shows logged out.

Fetch the latest data from iCloud. This command may fail, but it doesn’t matter.

Reset local Keychain database.

Reset iCloud Keychain database.

Log out and back in to the iCloud account on your macOS devices after completing these steps. if the size of ~/Library/Keychains/(UUID)/keychain-2.dbdecrease to about 10MB, indicates that the operation was successful. Please keep watching if App crashing happens again and the size of keychain-2.dbincreases apparently in the following period of time.

If the problem persisted after the operations, you can try the following approaches.

Wipe all the iOS devices that have logged into this iCloud account after backing up the devices.

Remove ~/Library/Keychains/(UUID)directory on macOS devices. Reboot the device immediately.This step can be replaced by wiping and reinstalling macOS if you wish.

Logout and login to iCloud after reboot. Then check CloudKit status.

Reset iCloud database immediately if status of every view is logged in.

将抹掉过的iOS设备重新登录iCloud,同时注意观察console上是否有出现大量的形如前文提到的日志。如果有,请重复上述步骤;如果没有,则持续使用并观察闪退现象是否复现及keychain-2.db的大小是否有明显增加。

Login to iCloud on your wiped iOS devices. Meanwhile pay attention to wether logs mentioned before appears in the console. 

If yes, please repeat these steps; If not, please keep watching if App crashing happens again and the size of keychain-2.dbincrease apparently.

Solution2:Turn off two-factor authentication

The approach is confirmed valid but has a specific scope of application.

Turn off two-factor authentication from appleid.apple.com. Note that it is Two-factor Authentication instead of Two-step Verification.

However, AppleIDs created in iOS 10.3 or macOS 10.12.4 and higher cannot turn off 2-factor authentication. If you have 2-factor authentication enabled under these system version, you can turn off 2-factor authentication by clicking the link in the confirmation email within two weeks, and you cannot turn it off for more than two weeks.

Alternative Solutions

If the solutions above does not work for you, you can try the following methods.

The following approaches are valid, but it may affect daily use.

  • Create a brand new iCloud account and manually migrate the data from your old account (use with caution! Dirty data on your device may contaminate your new account!)
  • Logging iOS devices out of iCloud account

The following solutions have been confirmed invalid

  • Logging out and back in to iCloud account
  • Logging macOS device out of iCloud account
  • Clearing the Safari password on iOS devices
  • Using Surge(A Network Extension app) to Reject the URL like p*.icloud.com to prevent iCloud from syncing
  • Turning off iCloud Keychain on iOS device
  • Reseting the Keychain database from Keychain Access

References

Show CommentsClose Comments

Leave a comment