I have found a way to reverse tether an iOS device, or connect it to the internet over the usb cable only. Many older ways to do this required an active data connection as you would set the proxy for that interface manually to use a usb tcp tunnel. The host is a Mac running the macOS High Sierra developer preview. The idevice is an iPhone 4s running iOS 7.1.2 jailbroken. The way I have done it is as follows:
Create a pppd tunnel. First, I installed libimobiledevice to setup a tcp tunnel to login with ssh to my idevice later:
iproxy 2022 22
then a dedicated tunnel for pppd to use:
iproxy 4444 4444
I now login to my idevice:
ssh localhost -p 2022
Now, the pppd tunnel, first from my idevice:
pppd noipdefault nodetach usepeerdns pty "nc -l -p 4444 localhost"
Notice that I am listening for a connection from the client. This is because iproxy only allows a connection to be initiated from the host computer. Now, on the host computer:
pppd 172.16.1.2:172.16.1.3 proxyarp usehostname ms-dns 8.8.8.8 nodetach pty "nc localhost 4444"
I am using nc as my connection, again because of the host only connection limitation.
After a few seconds, both the host and client pppd processes output the connection details:
client pppd:
Wed Sep 13 00:36:28 2017 : publish_entry SCDSet() failed: Success!
Wed Sep 13 00:36:28 2017 : publish_entry SCDSet() failed: Success!
Wed Sep 13 00:36:28 2017 : set_up_tty, can't set controlling terminal: Operation not permitted
Wed Sep 13 00:36:28 2017 : Using interface ppp0
Wed Sep 13 00:36:28 2017 : Connect: ppp0 <--> /dev/ttys003
Wed Sep 13 00:36:32 2017 : local IP address 172.16.1.3
Wed Sep 13 00:36:32 2017 : remote IP address 172.16.1.2
Wed Sep 13 00:36:32 2017 : primary DNS address 8.8.8.8
Wed Sep 13 00:36:32 2017 : secondary DNS address 8.8.8.8
host pppd:
Wed Sep 13 00:36:19 2017 : publish_entry SCDSet() failed: Success!
Wed Sep 13 00:36:19 2017 : publish_entry SCDSet() failed: Success!
Wed Sep 13 00:36:19 2017 : set_up_tty, can't set controlling terminal:
Operation not permitted
Wed Sep 13 00:36:19 2017 : Using interface ppp0
Wed Sep 13 00:36:19 2017 : Connect: ppp0 <--> /dev/ttys015
Wed Sep 13 00:36:20 2017 : found interface en1 for proxy arp
Wed Sep 13 00:36:20 2017 : local IP address 172.16.1.2
Wed Sep 13 00:36:20 2017 : remote IP address 172.16.1.3
Wed Sep 13 00:36:20 2017 : Committed PPP store
The idevice is now connected to my host machine. I have installed adv-cmds and network-cmds from Cydia, and so I have ifconfig, route, etc available. From my idevice:
$ ifconfig
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 16384
inet 127.0.0.1 netmask 0xff000000
pdp_ip0: flags=8010<POINTOPOINT,MULTICAST> mtu 1500
pdp_ip1: flags=8010<POINTOPOINT,MULTICAST> mtu 1500
pdp_ip2: flags=8010<POINTOPOINT,MULTICAST> mtu 1500
pdp_ip3: flags=8010<POINTOPOINT,MULTICAST> mtu 1500
en0: flags=8822<BROADCAST,SMART,SIMPLEX,MULTICAST> mtu 1500
ether c2:9f:42:7f:cd:1d
ppp0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 1500
inet 172.16.1.3 --> 172.16.1.2 netmask 0xffff0000
It is working! But I can't use it yet. The idevice doesn't have any routes for this new interface. My home network is on the 172.16 network, and I want to reach all devices on it. So I run:
route add -net 172.16 172.16.1.2
Now, if I open safari, I can access all devices on that network. If I go further, and do
route add default 172.16.1.2
I can access all numerical ip addresses, external and internal! However all domain names still return the dreaded "Safari cannot open the page because your iPhone is not connected to the Internet." Let's see my route setup:
$ netstat -rn
Routing tables
Internet:
Destination Gateway Flags Refs Use Netif Expire
default 172.16.1.2 UGSc 0 0 ppp0
127 127.0.0.1 UCS 0 0 lo0
127.0.0.1 127.0.0.1 UH 11 49203 lo0
172.16 172.16.1.2 UGSc 2 0 ppp0
172.16.1.2 172.16.1.3 UH 4 12 ppp0
224.0.0/4 lo0 UCS 0 0 lo0
I had a hunch that iOS includes a few system-related tools preinstalled, and that's how I found pppd.
$ ls /usr/sbin
BTAvrcp BlueTool addNetworkInterface distnoted ipconfig mkfile nvram rtadvd startupfiletool traceroute6 vipw zic
BTLEServer absd arp fairplayd.H1 mDNSResponder natd pppd scselect sysctl trpt wifid
BTMap ac aslmanager filecoordinationd mDNSResponderHelper ndp pwd_mkdb scutil syslogd update wirelessproxd
BTServer accton daily iostat mediaserverd notifyd racoon sshd traceroute vifs zdump
addNetworkInterface is a tool I've never seen before.
/usr/sbin/addNetworkInterface --help
options:
[-i <interface>]
[-c <controller>]
[-p] persistent host detection
[-s] route logging to syslog
Let's try it with ppp0:
/usr/sbin/addNetworkInterface -i ppp0
Looking for interface ppp0
Looking for all controllers
Looking for network interfaces...
Doesn't seem to do anything. Maybe the DNS isn't detected? In /usr/sbin I also found scutil, which I had seen before, in OS X. So,
$ scutil --dns
resolver #1
resolver #2
domain : local
options : mdns
timeout : 5
order : 300000
resolver #3
domain : 254.169.in-addr.arpa
options : mdns
timeout : 5
order : 300200
resolver #4
domain : 8.e.f.ip6.arpa
options : mdns
timeout : 5
order : 300400
resolver #5
domain : 9.e.f.ip6.arpa
options : mdns
timeout : 5
order : 300600
resolver #6
domain : a.e.f.ip6.arpa
options : mdns
timeout : 5
order : 300800
resolver #7
domain : b.e.f.ip6.arpa
options : mdns
timeout : 5
order : 301000
Hmm, no 8.8.8.8 (google public dns) And resolver #1 is empty. Let's see if iOS even sees ppp0:
$ scutil --nwi
IPv4 network interface information
No IPv4 states found
IPv6 network interface information
No IPv6 states found
Aha, iOS doesn't see my ppp0 interface. However, I happen to have an L2TP vpn server running at 172.16.12.1. I tried adding a vpn via settings for it, and it connects! I have internet access, and DNS is resolving. Let's see what changed:
$ ifconfig
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 16384
inet 127.0.0.1 netmask 0xff000000
pdp_ip0: flags=8010<POINTOPOINT,MULTICAST> mtu 1500
pdp_ip1: flags=8010<POINTOPOINT,MULTICAST> mtu 1500
pdp_ip2: flags=8010<POINTOPOINT,MULTICAST> mtu 1500
pdp_ip3: flags=8010<POINTOPOINT,MULTICAST> mtu 1500
en0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
ether c2:9f:42:7f:cd:1d
ppp0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 1500
inet 172.16.1.3 --> 172.16.1.2 netmask 0xffff0000
ppp1: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 1280
inet 172.17.0.6 --> 172.16.12.1 netmask 0xffff0000
Ok, let's try scutil:
$ scutil --nwi
IPv4 network interface information
ppp1 : flags 0x5 (IPv4,DNS)
reach 0x3 (Reachable,Transient Connection)
VPN server: 172.16.12.1
Signature Hash: <data> 0x3287f850c5bceebf3963027f203dfd222b245973
generation 890780619714
IPv6 network interface information
No IPv6 states found
Aha, iOS does see that vpn connection. Let's see the routing tables now:
$ netstat -rn
Routing tables
Internet:
Destination Gateway Flags Refs Use Netif Expire
default 172.16.12.1 UGSc 1 0 ppp1
127 127.0.0.1 UCS 0 0 lo0
127.0.0.1 127.0.0.1 UH 11 49349 lo0
172.16 172.16.1.2 UGSc 2 0 ppp0
172.16.1.2 172.16.1.3 UH 3 12 ppp0
172.16.12.1 172.17.0.7 UH 2 0 ppp1
172.17 ppp1 USc 0 0 ppp1
Note that my L2TP vpn server assigns addresses in the 172.17 network. Interesting... but that's exactly what I did with my pppd setup.
Let's try and see what scutil sees. You can enter interactive mode by just invoking scutil without arguments.
$ scutil
> list
subKey [0] = Plugin:IPConfiguration
subKey [1] = Plugin:InterfaceNamer
subKey [2] = Setup:
subKey [3] = Setup:/
subKey [4] = Setup:/Network/Global/IPv4
subKey [5] = Setup:/Network/HostNames
subKey [6] = Setup:/Network/Service/10D89B08-6E93-430C-BF49-A20670EFE79D
subKey [7] = Setup:/Network/Service/10D89B08-6E93-430C-BF49-A20670EFE79D/Interface
subKey [8] = Setup:/Network/Service/10D89B08-6E93-430C-BF49-A20670EFE79D/com.apple.CommCenter
subKey [9] = Setup:/Network/Service/10D89B08-6E93-430C-BF49-A20670EFE79D/com.apple.CommCenter/Setup
subKey [10] = Setup:/Network/Service/23C902DC-A50E-4873-8A40-F9EFF62CCE97
subKey [11] = Setup:/Network/Service/23C902DC-A50E-4873-8A40-F9EFF62CCE97/IPv4
subKey [12] = Setup:/Network/Service/23C902DC-A50E-4873-8A40-F9EFF62CCE97/IPv6
subKey [13] = Setup:/Network/Service/23C902DC-A50E-4873-8A40-F9EFF62CCE97/Interface
subKey [14] = Setup:/Network/Service/23C902DC-A50E-4873-8A40-F9EFF62CCE97/Proxies
subKey [15] = Setup:/Network/Service/261FD5D3-87FF-4D60-A3C2-66A8B785BFF7
subKey [16] = Setup:/Network/Service/261FD5D3-87FF-4D60-A3C2-66A8B785BFF7/Interface
subKey [17] = Setup:/Network/Service/261FD5D3-87FF-4D60-A3C2-66A8B785BFF7/com.apple.CommCenter
subKey [18] = Setup:/Network/Service/AFA7F205-4647-4C6D-890E-9925C4909BE2
subKey [19] = Setup:/Network/Service/AFA7F205-4647-4C6D-890E-9925C4909BE2/Interface
subKey [20] = Setup:/Network/Service/AFA7F205-4647-4C6D-890E-9925C4909BE2/com.apple.CommCenter
subKey [21] = Setup:/Network/Service/AFA7F205-4647-4C6D-890E-9925C4909BE2/com.apple.CommCenter/Setup
subKey [22] = Setup:/Network/Service/B7F49FAB-68BA-483B-8867-8190FD5B94ED
subKey [23] = Setup:/Network/Service/B7F49FAB-68BA-483B-8867-8190FD5B94ED/Interface
subKey [24] = Setup:/Network/Service/B7F49FAB-68BA-483B-8867-8190FD5B94ED/com.apple.CommCenter
subKey [25] = Setup:/Network/Service/FF84E6AB-D5D4-4CE0-A9EE-FBAB5DE824C7
subKey [26] = Setup:/Network/Service/FF84E6AB-D5D4-4CE0-A9EE-FBAB5DE824C7/IPSec
subKey [27] = Setup:/Network/Service/FF84E6AB-D5D4-4CE0-A9EE-FBAB5DE824C7/IPv4
subKey [28] = Setup:/Network/Service/FF84E6AB-D5D4-4CE0-A9EE-FBAB5DE824C7/IPv6
subKey [29] = Setup:/Network/Service/FF84E6AB-D5D4-4CE0-A9EE-FBAB5DE824C7/Interface
subKey [30] = Setup:/Network/Service/FF84E6AB-D5D4-4CE0-A9EE-FBAB5DE824C7/PPP
subKey [31] = Setup:/Network/Service/FF84E6AB-D5D4-4CE0-A9EE-FBAB5DE824C7/Proxies
subKey [32] = Setup:/System
subKey [33] = State:/IOKit/LowBatteryWarning
subKey [34] = State:/IOKit/PowerAdapter
subKey [35] = State:/IOKit/PowerManagement/CurrentSettings
subKey [36] = State:/IOKit/PowerManagement/SystemLoad
subKey [37] = State:/IOKit/PowerManagement/SystemLoad/Detailed
subKey [38] = State:/IOKit/PowerSources/InternalBattery-0
subKey [39] = State:/Network/Global/DNS
subKey [40] = State:/Network/Global/IPv4
subKey [41] = State:/Network/Global/Proxies
subKey [42] = State:/Network/Interface
subKey [43] = State:/Network/Interface/en0/Link
subKey [44] = State:/Network/Interface/lo0/IPv4
subKey [45] = State:/Network/Interface/lo0/IPv6
subKey [46] = State:/Network/Interface/lo0/LinkQuality
subKey [47] = State:/Network/Interface/pdp_ip0/LinkQuality
subKey [48] = State:/Network/Interface/pdp_ip1/LinkQuality
subKey [49] = State:/Network/Interface/pdp_ip2/LinkQuality
subKey [50] = State:/Network/Interface/pdp_ip3/LinkQuality
subKey [51] = State:/Network/Interface/ppp0/IPv4
subKey [52] = State:/Network/Interface/ppp1/IPv4
subKey [53] = State:/Network/MulticastDNS
subKey [54] = State:/Network/Service/10D89B08-6E93-430C-BF49-A20670EFE79D
subKey [55] = State:/Network/Service/10D89B08-6E93-430C-BF49-A20670EFE79D/com.apple.CommCenter
subKey [56] = State:/Network/Service/261FD5D3-87FF-4D60-A3C2-66A8B785BFF7/com.apple.CommCenter
subKey [57] = State:/Network/Service/AAAAAAAA-AAAA-AAAA-AAAA-AAAAAAAAAAAA
subKey [58] = State:/Network/Service/AAAAAAAA-AAAA-AAAA-AAAA-AAAAAAAAAAAA/DNS
subKey [59] = State:/Network/Service/AAAAAAAA-AAAA-AAAA-AAAA-AAAAAAAAAAAA/IPv4
subKey [60] = State:/Network/Service/AAAAAAAA-AAAA-AAAA-AAAA-AAAAAAAAAAAA/IPv6
subKey [61] = State:/Network/Service/AAAAAAAA-AAAA-AAAA-AAAA-AAAAAAAAAAAA/PPP
subKey [62] = State:/Network/Service/AFA7F205-4647-4C6D-890E-9925C4909BE2/com.apple.CommCenter
subKey [63] = State:/Network/Service/B7F49FAB-68BA-483B-8867-8190FD5B94ED/com.apple.CommCenter
subKey [64] = State:/Network/Service/FF84E6AB-D5D4-4CE0-A9EE-FBAB5DE824C7/DNS
subKey [65] = State:/Network/Service/FF84E6AB-D5D4-4CE0-A9EE-FBAB5DE824C7/IPv4
subKey [66] = State:/Network/Service/FF84E6AB-D5D4-4CE0-A9EE-FBAB5DE824C7/IPv6
subKey [67] = State:/Network/Service/FF84E6AB-D5D4-4CE0-A9EE-FBAB5DE824C7/PPP
subKey [68] = State:/Network/Service/FF84E6AB-D5D4-4CE0-A9EE-FBAB5DE824C7/Proxies
subKey [69] = State:/Network/mDNSResponder/DebugState
subKey [70] = com.apple.CFNetwork.netcompat.HTTPPipelining:VPN.RemoteAddress=172.16.12.1
subKey [71] = com.apple.CFNetwork.netcompat.TLSFalseStart:VPN.RemoteAddress=172.16.12.1
subKey [72] = com.apple.CFNetwork.netcompat:com.apple.CFNetwork.netcompat.lastpurge
subKey [73] = com.apple.MobileInternetSharing
So iOS has a whole lot of interfaces set up. I'm only interested in the active one, my l2tp vpn, which is ppp1. So:
> get State:/Network/Global/IPv4
> d.show
<dictionary> {
PrimaryInterface : ppp1
PrimaryService : FF84E6AB-D5D4-4CE0-A9EE-FBAB5DE824C7
Router : 172.16.12.1
}
> get State:/Network/Global/DNS
> d.show
<dictionary> {
ServerAddresses : <array> {
0 : 8.8.8.8
1 : 8.8.4.4
}
}
So it is defined there. Let's get all the values for the PrimaryService:
> get State:/Network/Service/FF84E6AB-D5D4-4CE0-A9EE-FBAB5DE824C7/DNS
> d.show
<dictionary> {
ServerAddresses : <array> {
0 : 8.8.8.8
1 : 8.8.4.4
}
SupplementalMatchDomains : <array> {
0 :
}
SupplementalMatchOrders : <array> {
0 : 100000
}
}
> get State:/Network/Service/FF84E6AB-D5D4-4CE0-A9EE-FBAB5DE824C7/IPv4
> d.show
<dictionary> {
Addresses : <array> {
0 : 172.17.0.7
}
DestAddresses : <array> {
0 : 172.16.12.1
}
InterfaceName : ppp1
NetworkSignature : VPN.RemoteAddress=172.16.12.1
OverridePrimary : 1
Router : 172.16.12.1
ServerAddress : 172.16.12.1
}
> get State:/Network/Service/FF84E6AB-D5D4-4CE0-A9EE-FBAB5DE824C7/PPP
> d.show
<dictionary> {
CommRemoteAddress : 172.16.12.1
ConnectTime : 37417
IPCPCompressionVJ : 0
InterfaceName : ppp1
LCPCompressionACField : 1
LCPCompressionPField : 1
LCPMRU : 1500
LCPMTU : 1280
Status : 8
}
All defined. Let's see it without the L2TP vpn connected:
> list
subKey [0] = Plugin:IPConfiguration
subKey [1] = Plugin:InterfaceNamer
subKey [2] = Setup:
subKey [3] = Setup:/
subKey [4] = Setup:/Network/Global/IPv4
subKey [5] = Setup:/Network/HostNames
subKey [6] = Setup:/Network/Service/10D89B08-6E93-430C-BF49-A20670EFE79D
subKey [7] = Setup:/Network/Service/10D89B08-6E93-430C-BF49-A20670EFE79D/Interface
subKey [8] = Setup:/Network/Service/10D89B08-6E93-430C-BF49-A20670EFE79D/com.apple.CommCenter
subKey [9] = Setup:/Network/Service/10D89B08-6E93-430C-BF49-A20670EFE79D/com.apple.CommCenter/Setup
subKey [10] = Setup:/Network/Service/23C902DC-A50E-4873-8A40-F9EFF62CCE97
subKey [11] = Setup:/Network/Service/23C902DC-A50E-4873-8A40-F9EFF62CCE97/IPv4
subKey [12] = Setup:/Network/Service/23C902DC-A50E-4873-8A40-F9EFF62CCE97/IPv6
subKey [13] = Setup:/Network/Service/23C902DC-A50E-4873-8A40-F9EFF62CCE97/Interface
subKey [14] = Setup:/Network/Service/23C902DC-A50E-4873-8A40-F9EFF62CCE97/Proxies
subKey [15] = Setup:/Network/Service/261FD5D3-87FF-4D60-A3C2-66A8B785BFF7
subKey [16] = Setup:/Network/Service/261FD5D3-87FF-4D60-A3C2-66A8B785BFF7/Interface
subKey [17] = Setup:/Network/Service/261FD5D3-87FF-4D60-A3C2-66A8B785BFF7/com.apple.CommCenter
subKey [18] = Setup:/Network/Service/AFA7F205-4647-4C6D-890E-9925C4909BE2
subKey [19] = Setup:/Network/Service/AFA7F205-4647-4C6D-890E-9925C4909BE2/Interface
subKey [20] = Setup:/Network/Service/AFA7F205-4647-4C6D-890E-9925C4909BE2/com.apple.CommCenter
subKey [21] = Setup:/Network/Service/AFA7F205-4647-4C6D-890E-9925C4909BE2/com.apple.CommCenter/Setup
subKey [22] = Setup:/Network/Service/B7F49FAB-68BA-483B-8867-8190FD5B94ED
subKey [23] = Setup:/Network/Service/B7F49FAB-68BA-483B-8867-8190FD5B94ED/Interface
subKey [24] = Setup:/Network/Service/B7F49FAB-68BA-483B-8867-8190FD5B94ED/com.apple.CommCenter
subKey [25] = Setup:/Network/Service/FF84E6AB-D5D4-4CE0-A9EE-FBAB5DE824C7
subKey [26] = Setup:/Network/Service/FF84E6AB-D5D4-4CE0-A9EE-FBAB5DE824C7/IPSec
subKey [27] = Setup:/Network/Service/FF84E6AB-D5D4-4CE0-A9EE-FBAB5DE824C7/IPv4
subKey [28] = Setup:/Network/Service/FF84E6AB-D5D4-4CE0-A9EE-FBAB5DE824C7/IPv6
subKey [29] = Setup:/Network/Service/FF84E6AB-D5D4-4CE0-A9EE-FBAB5DE824C7/Interface
subKey [30] = Setup:/Network/Service/FF84E6AB-D5D4-4CE0-A9EE-FBAB5DE824C7/PPP
subKey [31] = Setup:/Network/Service/FF84E6AB-D5D4-4CE0-A9EE-FBAB5DE824C7/Proxies
subKey [32] = Setup:/System
subKey [33] = State:/IOKit/LowBatteryWarning
subKey [34] = State:/IOKit/PowerAdapter
subKey [35] = State:/IOKit/PowerManagement/CurrentSettings
subKey [36] = State:/IOKit/PowerManagement/SystemLoad
subKey [37] = State:/IOKit/PowerManagement/SystemLoad/Detailed
subKey [38] = State:/IOKit/PowerSources/InternalBattery-0
subKey [39] = State:/Network/Global/Proxies
subKey [40] = State:/Network/Interface
subKey [41] = State:/Network/Interface/en0/Link
subKey [42] = State:/Network/Interface/lo0/IPv4
subKey [43] = State:/Network/Interface/lo0/IPv6
subKey [44] = State:/Network/Interface/lo0/LinkQuality
subKey [45] = State:/Network/Interface/pdp_ip0/LinkQuality
subKey [46] = State:/Network/Interface/pdp_ip1/LinkQuality
subKey [47] = State:/Network/Interface/pdp_ip2/LinkQuality
subKey [48] = State:/Network/Interface/pdp_ip3/LinkQuality
subKey [49] = State:/Network/Interface/ppp0/IPv4
subKey [50] = State:/Network/MulticastDNS
subKey [51] = State:/Network/Service/10D89B08-6E93-430C-BF49-A20670EFE79D
subKey [52] = State:/Network/Service/10D89B08-6E93-430C-BF49-A20670EFE79D/com.apple.CommCenter
subKey [53] = State:/Network/Service/261FD5D3-87FF-4D60-A3C2-66A8B785BFF7/com.apple.CommCenter
subKey [54] = State:/Network/Service/AAAAAAAA-AAAA-AAAA-AAAA-AAAAAAAAAAAA
subKey [55] = State:/Network/Service/AAAAAAAA-AAAA-AAAA-AAAA-AAAAAAAAAAAA/DNS
subKey [56] = State:/Network/Service/AAAAAAAA-AAAA-AAAA-AAAA-AAAAAAAAAAAA/IPv4
subKey [57] = State:/Network/Service/AAAAAAAA-AAAA-AAAA-AAAA-AAAAAAAAAAAA/IPv6
subKey [58] = State:/Network/Service/AAAAAAAA-AAAA-AAAA-AAAA-AAAAAAAAAAAA/PPP
subKey [59] = State:/Network/Service/AFA7F205-4647-4C6D-890E-9925C4909BE2/com.apple.CommCenter
subKey [60] = State:/Network/Service/B7F49FAB-68BA-483B-8867-8190FD5B94ED/com.apple.CommCenter
subKey [61] = State:/Network/mDNSResponder/DebugState
subKey [62] = com.apple.CFNetwork.netcompat.HTTPPipelining:VPN.RemoteAddress=172.16.12.1
subKey [63] = com.apple.CFNetwork.netcompat.TLSFalseStart:VPN.RemoteAddress=172.16.12.1
subKey [64] = com.apple.CFNetwork.netcompat:com.apple.CFNetwork.netcompat.lastpurge
subKey [65] = com.apple.MobileInternetSharing
All the configuration is gone. That's why it is not working. Note that the service AAAAAAAA-AAAA-AAAA-AAAA-AAAAAAAAAAAA is one I tried manually making and adding all the keys like they were set up for ppp1 but replacing it with ppp0 but it didn't work.
So, is it possible to add ppp0 via scutil or some other way, such that the DNS addresses work, and iOS is aware that it IS an internet connection, that apps can use?