Analysis of Abnormal Data Consumption and App Crashing on iOS Devices

Frank发布

点击这里前往中文版/Click here for Chinese version

This is the third knotty issue happened on my Apple devices.

By the end of June this year, my iPhone running iOS11.4 ran nearly 10G of mobile data during a single day. The log of Shadowrocket(An Network Extension app) revealed that my iPhone kept downloading unknown data from gateway.icloud.com at the rate of about 200kb/s. I tried switching the iCloud account, but the problem appeared again after a short period of time. I was busy dealing with the exams at that time, so I simply Rejected gateway.icloud.com in Shadowrocket. No negative influence on daily use.

After some searching, I found some people claimed they have encountered a similar problems (22nd floor): https://www.v2ex.com/t/459452 . However, his solution of logging out of iCloud on macOS devices was not successful for me.

But the trouble didn’t end. Since then, a large number of apps crashes while launching on my iPhone and iPad at a frequency of 2-3 times a week. When the problem occurs, most applications will hang at the Splash Screen and crash after about 10 seconds. Applications that crashed including TIM, Notability and all of the Google apps. WeChat and Apple’s own applications are unaffected. During this time, the phone went hot, and will stuck when entering the iCloud settings. My iPhone runs iOS 11.4 and 12 Public Beta, and iPad running 11.4 and 12 Developer Beta.

Attempts

I tried rebooting, force rebooting, reinstalling affected apps, upgrading iOS, logging out and logging back in to iCloud, didn’t work. A temporary solution is turning the iCloud Drive switch off and on, which has a chance to temporarily fix the problem. However, entering the iCloud settings at this time has a high probability of being stuck, so you need to try several times. The iPhone will recover from the problem after a while even if not doing anything.

Analysis

Because this problem is very subtle, each person’s description varies, thus difficult to search online. Here is a collection of posts and threads complaining about the issue.
https://www.v2ex.com/t/460089
https://www.v2ex.com/t/471491
https://cn0xroot.com/2018/07/17/2018-07-16/
https://www.v2ex.com/t/459452
https://discussionschinese.apple.com/thread/140132632
https://www.reddit.com/r/jailbreak/comments/8sf4u3/help_this_block_of_text_is_being_spammed_in_my/
https://forums.developer.apple.com/thread/105722
https://forums.macrumors.com/threads/excessive-data-consumption-for-documents-sync-and-constantly-high-cpu-load-on-iphone-and-ipad.2127349/

The problem happens randomly. I have no idea how it is triggered thus no way to reproduce it manually. Considering toggling the iCloud Drive have a chance to temporarily fix this problem, I figured the problem is related to iCloud. As for the iCloud continuous download data problem that has appeared before, I guess there is a correlation between the two issues.

The console revealed that Provision violated for watchdog scene - create message shows in the console when an app launches and crashes.This error message is caused by app forcibly killed by the system due to the long startup time.

Meanwhile, while the problem happens, a large number of the following logs appears in the console, up to dozens per second. (The log is very long, please slide to the right)

Through the com.apple.ProtectedCloudStorage in the log, I preliminarily targeted that the issue appears in the Keychain. But I have no idea what Manatee is after not finding valuable information on the search engine.

I found a thread on Reddit by searching the contents of the log: https://www.reddit.com/r/jailbreak/comments/8sf4u3/help_this_block_of_text_is_being_spammed_in_my/ . The author nhcoil and I encountered almost the same problem. I sent a private message and I got the following reply:

Never found the solution. Brought my phone in multiple times and nothing, even got a replacement device and the issue persisted. The problem was something in my iCloud. I don’t know what, didn’t have anything in there at all.
Holy solution was creating a new iCloud account and not carrying anything over and manually putting everything like contacts etc.
I’m sorry I can’t be much help, I spoke with Apple live chat about the issue and gave everything I could to isolate and help with the problem.
If you do find a solution other than a new iCloud account, then that’s amazing but for now I think that’s all that can be done.
Regards,
Micheal

Studying the logs above and the information provided by nhcoil, I inferred that the problem is caused by some problems in the data in iCloud, resulting in unexpected synchronization errors, and the problem is likely to appear in the Keychain.

Then I searched for this thread https://forums.developer.apple.com/thread/105722 . More information is provided in the thread:

This process will continue writing around 30000 lines to the database, and during this time, secd uses 100%+ of a CPU. Once that’s finished, I can manually edit the database using an Sqlite editor, which brings the database down to around 10-15MB, and Safari passwords will resume working. Eventually the database will grow again and Keychain stops working.

Signing all devices out of iCloud Keychain does not clear this problem. Computers running 10.11.6 and 10.12.6 work normally, so the problem seems to stem from some new feature in iOS 11 and macOS 10.13.

I went to the local Keychain database on my MacBook, and I found tons of data containing Manatee , up to tens thousands of lines, and these data will not be displayed in Keychain Access.

I believe there are similar data in my iCloud Keychain, but I have no way to view or delete it.

Continuing the search, I found another thread on MacRumors: https://forums.macrumors.com/threads/excessive-data-consumption-for-documents-sync-and-constantly-high-cpu-load-on-iphone-and-ipad.2127349/ . From the information provided in the thread, we can determine that the problem is indeed in the Keychain.

Moreover, both of these threads mentioned that when 2-factor authentication is disabled, the problem will not happen again, and it can be regarded as a relatively feasible solution.

Solutions

Solutions that have been confirmed invalid:

  • Logging out and back in to iCloud account
  • Logging out your macOS device to iCloud account
  • Clearing the Safari password on your iOS device
  • Using Surge(A Network Extension app) to Reject the URL like p**-*.icloud.com to prevent iCloud from syncing
  • Turning off iCloud Keychain on iOS device

Solutions that cannot be confirmed effective yet, but worth trying:

  • Reseting the Keychain database from Keychain Access
  • Turning off 2-factor authentication for iCloud accounts

The solution described by nhcoil is also feasible: creating a brand new iCloud account and manually migrate the data from the old account.

Reference

https://forums.developer.apple.com/thread/105722
https://forums.macrumors.com/threads/excessive-data-consumption-for-documents-sync-and-constantly-high-cpu-load-on-iphone-and-ipad.2127349/
https://arstechnica.com/civis/viewtopic.php?f=19&t=1433841
https://www.reddit.com/r/jailbroke2/comments/8sgj2n/help_this_block_of_text_is_being_spammed_in_my/
https://www.v2ex.com/t/459452

https://forums.developer.apple.com/thread/104020
https://stackoverflow.com/questions/26827809/app-rejection-crash-report-says-failed-to-scene-create-in-time-badf00d-what
https://hitcon.org/2017/CMT/slide-files/d1_s2_r2.pdf

分类: 原创文章

发表评论

电子邮件地址不会被公开。 必填项已用*标注

Captcha *

%d 博主赞过: